EUVD-2026-20552Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify MRI feedback popup endpoint
-
DeliveryCraft malicious SQL injection payload
-
ExploitSubmit via vulnerable parameter
-
ExecutionExtract sensitive database records
-
ImpactExfiltrate research data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit SQL injection in the MRI feedback popup window of LORIS imaging browser versions prior to 27.0.3 and 28.0.1. No user interaction required. Affects self-hosted LORIS installations with default configurations. |
| Impact | Network-accessible SQL injection in unauthenticated MRI feedback popup enables direct database read access without user interaction. CVSS 7.5 reflects confidentiality impact on sensitive neuroimaging data. Priority depends on deployment scope-self-hosted academic systems may have limited external exposure, reducing blast radius versus public instances. |
| Exploit ScenarioDerived | Attacker crafts malicious SQL payload in MRI feedback popup parameters via HTTP GET/POST. No authentication required; payload executes directly against database, exfiltrating patient neuroimaging records or project metadata in single request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
SQL injection in LORIS neuroimaging research platform versions prior to 27.0.3 and 28.0.1 enables unauthenticated remote attackers to extract or modify database contents via the MRI feedback popup window in the imaging browser module. The vulnerability permits unauthorized access to sensitive neuroimaging research data and project management information without authentication. CVSS 7.5 (High severity) reflects network-accessible attack vector with low complexity. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to LORIS version 27.0.3 (for 27.x deployments) or 28.0.1 (for 28.x deployments). These releases implement parameterized queries and input validation to prevent SQL injection in the MRI feedback popup. No workarounds exist; upgrade is mandatory. Installations using affected versions should audit database access logs for suspicious query patterns prior to patching. Consult official security advisory for upgrade procedures: https://github.com/aces/Loris/security/advisories/GHSA-9r29-6jgc-3ggh. Post-upgrade, verify imaging browser MRI feedback functionality operates normally without SQL injection risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Unsafe SQL query construction in MRI feedback popup code allows direct database query manipulation. CWE-89 SQL injection stems from inadequate input sanitization in imaging browser's feedback window handler. Attack requires no authentication (PR:N) and exploits LORIS's web application tier to bypass database access controls.
Know when Loris gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1.
Executive ViewAI
LORIS neuroimaging research platform versions prior to 27.0.3 and 28.0.1 contain an unauthenticated SQL injection vulnerability in the imaging browser module that allows remote attackers to extract or modify sensitive research data and project information without credentials. Organizations deploying LORIS for clinical or research neuroimaging studies face immediate risk of data breach and research integrity compromise affecting patient privacy and regulatory compliance.
Apply vendor patch. If immediate patching is not feasible, restrict network access to LORIS imaging browser module to authenticated VPN or internal networks only; disable or restrict the MRI feedback popup functionality until patch is applied; implement WAF rules to block common SQL injection payloads targeting the imaging browser module; enable database query logging and set alerts for anomalous SELECT/UPDATE/DELETE activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote code execution in LORIS neuroimaging platform allows authenticated users with sufficient privileges to bypass pat
Path traversal in LORIS neuroimaging research platform versions 24.0.0 through 27.0.2 and 28.0.0 allows authenticated at
Authenticated users in LORIS 24.0.0 through 28.0.0 can exploit a path traversal vulnerability to read arbitrary configur
Path traversal in LORIS neuroimaging research platform (versions 20.0.0 through 27.0.2 and 28.0.0) enables unauthenticat
LORIS (Longitudinal Online Research and Imaging System) versions 16.1.0 through 27.0.2 and 28.0.0 allow authenticated us
LORIS versions 21.0.0 through 27.0.2 and 28.0.0 suffer from broken access control in the document_repository backend end
Missing authorization checks in the LORIS imaging_browser API allow any authenticated API caller to modify imaging data
Open redirect vulnerability in LORIS (Longitudinal Online Research and Imaging System) versions prior to 27.0.3 and 28.0
Cross-site scripting (XSS) in LORIS survey_accounts module (versions 15.10 through 27.0.2 and 28.0.0) allows authenticat
Reflected cross-site scripting and arbitrary markdown file download in LORIS help_editor module affects versions prior t
LORIS deployments running the Issue Tracker module expose a missing-authorization flaw in which the backend edit endpoin
LORIS (Longitudinal Online Research and Imaging System) versions 20.0.0 through 27.0.2 and 28.0.0 allow authenticated us
Exploit-DB