EUVD-2026-20557Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
7DescriptionGitHub Advisory
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.
AnalysisAI
Path traversal in LORIS neuroimaging research platform (versions 20.0.0 through 27.0.2 and 28.0.0) enables unauthenticated remote attackers to download arbitrary files outside intended directories via malicious requests to static file router endpoints (/static, /css, /js). Vulnerability permits high-impact information disclosure including sensitive research data, configuration files, and potentially database credentials. No public exploit identified at time of analysis. Affects self-hosted LORIS installations across academic and clinical neuroimaging research environments.
Technical ContextAI
Directory traversal flaw in static file routing logic fails to sanitize path parameters, allowing '../' sequences to escape document root boundaries. CWE-552 (externally accessible file/directory) combined with absent input validation on file path construction. CVSS vector PR:N confirms unauthenticated exploitation over network without user interaction.
RemediationAI
Vendor-released patch: upgrade immediately to LORIS 27.0.3 (for 27.x branch) or 28.0.1 (for 28.x branch). Both versions contain corrected static file router logic with path validation. No workaround available for unpatched versions; vulnerability resides in core routing component requiring code-level fix. Organizations unable to upgrade immediately should restrict network access to LORIS instances via firewall rules limiting exposure to trusted IP ranges. Review web server access logs for suspicious requests containing traversal sequences (../ or URL-encoded equivalents) targeting /static, /css, /js endpoints. Full advisory and patch details: https://github.com/aces/Loris/security/advisories/GHSA-rfj5-58hv-wc5f
Remote code execution in LORIS neuroimaging platform allows authenticated users with sufficient privileges to bypass pat
Reflected cross-site scripting and arbitrary markdown file download in LORIS help_editor module affects versions prior t
Authenticated users in LORIS 24.0.0 through 28.0.0 can exploit a path traversal vulnerability to read arbitrary configur
Path traversal in LORIS neuroimaging research platform versions 24.0.0 through 27.0.2 and 28.0.0 allows authenticated at
SQL injection in LORIS neuroimaging research platform versions prior to 27.0.3 and 28.0.1 enables unauthenticated remote
Cross-site scripting (XSS) in LORIS survey_accounts module (versions 15.10 through 27.0.2 and 28.0.0) allows authenticat
LORIS (Longitudinal Online Research and Imaging System) versions 16.1.0 through 27.0.2 and 28.0.0 allow authenticated us
LORIS versions 21.0.0 through 27.0.2 and 28.0.0 suffer from broken access control in the document_repository backend end
LORIS (Longitudinal Online Research and Imaging System) versions 20.0.0 through 27.0.2 and 28.0.0 allow authenticated us
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today