What is the CVSS score of CVE-2026-35446?

CVE-2026-35446 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-35446?

Within 24 hours: Identify all LORIS deployments and document current versions running. Within 7 days: Apply vendor-released patch to upgrade affected versions (24.0.0-27.0.2 and 28.0.0) to patched release; verify FilesDownloadHandler now enforces proper directory restriction checks. Within 30 days: Audit access logs for suspicious file download patterns by authenticated users; review file access permissions to enforce principle of least privilege for research staff accounts.

Loris CVE-2026-35446

Q: Which versions of Loris are affected by CVE-2026-35446?

LORIS neuroimaging platform versions 24.0.0-28.0.2 contain a path traversal vulnerability allowing authenticated users to access files outside designated directories, creating risk of unauthorized…. A patch is available.

EUVD-2026-20580 HIGH

Files or Directories Accessible to External Parties (CWE-552)

2026-04-08 GitHub_M

Information Disclosure Path Traversal Loris Aces

8.6

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privilege LORIS user
Delivery

Craft malicious path traversal request
Exploit

Bypass FilesDownloadHandler directory validation
Execution

Access files outside download directories
Impact

Exfiltrate sensitive neuroimaging research data

Vulnerability Assessment

Weakness	CWE CWE-552 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling File access restriction MITRE ATT&CK 2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires authenticated user account on LORIS 24.0.0–27.0.2 or 28.0.0. Attacker with low-privilege login credentials can remotely exploit path traversal in FilesDownloadHandler to access files outside intended download directories without user interaction.
Impact	High-severity path traversal enabling authenticated users to read arbitrary files across the system. CVSS 7.7 reflects confidentiality impact with network accessibility and low attack complexity. EPSS indicates moderate observed exploitation activity. Primary concern: neuroimaging systems often store sensitive patient data; lateral access to configuration files or research datasets poses significant disclosure risk. Requires authenticated access, reducing immediate threat surface but concerning for insider scenarios.
Exploit ScenarioDerived	Authenticated researcher submits crafted download request with path traversal sequences (e.g., `../../../etc/passwd`) to FilesDownloadHandler. Due to incorrect operation ordering, traversal checks bypass intended directory restrictions, returning sensitive files. No public POC identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 08, 2026

Path traversal in LORIS neuroimaging research platform versions 24.0.0 through 27.0.2 and 28.0.0 allows authenticated attackers to bypass directory restrictions in FilesDownloadHandler, enabling unauthorized access to files outside intended download directories. The vulnerability exploits incorrect operation ordering during file access validation, permitting low-privileged authenticated users to exfiltrate sensitive neuroimaging data and project files across organizational boundaries. CVSS 7.7 severity reflects cross-scope confidentiality breach with network accessibility and low attack complexity. No public exploit identified at time of analysis.

RemediationAI

Vendor-released patches: upgrade to LORIS 27.0.3 or 28.0.1, which correct the operation sequence in FilesDownloadHandler to validate path boundaries before file access. For version 27.x deployments, apply 27.0.3; for version 28.x, apply 28.0.1. Installations on unsupported 24.x-26.x branches must migrate to supported release train. No effective workaround exists without code modification; file download functionality cannot be safely disabled without breaking core research workflows. Verify patch application by testing directory traversal sequences (../, absolute paths) are rejected post-upgrade. Official security advisory with detailed remediation steps: https://github.com/aces/Loris/security/advisories/GHSA-47jj-7xfg-8759

Affected VersionsENISA

Loris 24.0.0, < 27.0.3

Loris 28.0.0, < 28.0.1

Affected Packages

euvd loris_24_0_0 fix: 27.0.3

euvd loris_28_0_0 fix: 28.0.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-552 (Files or Directories Accessible to External Parties) manifests through operation-ordering flaw in FilesDownloadHandler class. Authentication requirement (PR:L) indicates low-privileged user exploitation. Cross-scope impact (S:C) suggests access beyond user's assigned research projects. Root cause lies in premature path resolution before security boundary enforcement, enabling classic directory escape sequences.

Know when Loris gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 24, 2026 - 21:22 NVD

7.7 (HIGH) 8.6 (HIGH)

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

27.0.3,28.0.1

CVE Published

Apr 08, 2026 - 18:28 nvd

HIGH 7.7

DescriptionNVD

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.

Executive ViewAI

Why It Matters

LORIS neuroimaging platform versions 24.0.0-28.0.2 contain a path traversal vulnerability allowing authenticated users to access files outside designated directories, creating risk of unauthorized exposure of sensitive research data and project files. Organizations using LORIS for clinical or research neuroimaging must patch immediately to prevent low-privileged users from exfiltrating confidential patient imaging data and institutional research assets.

Business Impact: High

Compensating Controls

Apply vendor patch. Until patched: restrict network access to LORIS FilesDownloadHandler endpoints via firewall to trusted research networks only; implement strict role-based access controls limiting file download permissions to essential research personnel; enable and monitor audit logging of all file download requests; conduct access review of existing authenticated user accounts to disable unnecessary credentials.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +43

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.