What is the CVSS score of EUVD-2026-20557?

EUVD-2026-20557 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-20557?

Within 24 hours: identify all LORIS deployments in your environment and document current versions; isolate or restrict network access to affected LORIS instances if patched versions are unavailable. Within 7 days: upgrade all LORIS installations to version 28.0.3 or later (or equivalent patched release per vendor advisory); validate upgrade completion and restart services. Within 30 days: conduct file access audit logs to detect unauthorized downloads from /static, /css, /js endpoints; assess whether sensitive research data, credentials, or configurations were accessed; notify research stakeholders and compliance officers if unauthorized access is confirmed.

Loris EUVD-2026-20557

Q: Which versions of Loris are affected by EUVD-2026-20557?

LORIS neuroimaging platform versions 20.0.0-27.0.2 and 28.0.0 contain an unauthenticated path traversal vulnerability allowing attackers to download arbitrary files from affected servers, creating…. A patch is available.

| CVE-2026-34392 HIGH

Files or Directories Accessible to External Parties (CWE-552)

2026-04-08 GitHub_M

Information Disclosure Path Traversal Loris Aces

7.5

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft HTTP request with path traversal sequence
Exploit

Route through static/css/js endpoint
Execution

Bypass directory validation
Impact

Download sensitive files outside intended directory

Vulnerability Assessment

Weakness	CWE CWE-552 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling File access restriction MITRE ATT&CK 2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	LORIS versions 20.0.0 through 27.0.2 and 28.0.0. Remote unauthenticated attacker can exploit via crafted requests to static, css, or js endpoints. No victim interaction required. Default configurations vulnerable.
Impact	Path traversal in static file endpoints enables unauthenticated remote file disclosure with high confidence (CVSS 7.5, C:H). Self-hosted neuroimaging systems may expose sensitive research data, patient information, or credentials. EPSS data unavailable; prioritize patching based on deployment sensitivity and internet exposure rather than observed exploitation rates.
Exploit ScenarioDerived	Attacker crafts traversal payload (e.g., GET /static/../../config.php) targeting unauthenticated static/css/js endpoints. Network-accessible LORIS instance returns arbitrary files from host filesystem. No public exploit identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 08, 2026

Path traversal in LORIS neuroimaging research platform (versions 20.0.0 through 27.0.2 and 28.0.0) enables unauthenticated remote attackers to download arbitrary files outside intended directories via malicious requests to static file router endpoints (/static, /css, /js). Vulnerability permits high-impact information disclosure including sensitive research data, configuration files, and potentially database credentials. No public exploit identified at time of analysis. Affects self-hosted LORIS installations across academic and clinical neuroimaging research environments.

RemediationAI

Vendor-released patch: upgrade immediately to LORIS 27.0.3 (for 27.x branch) or 28.0.1 (for 28.x branch). Both versions contain corrected static file router logic with path validation. No workaround available for unpatched versions; vulnerability resides in core routing component requiring code-level fix. Organizations unable to upgrade immediately should restrict network access to LORIS instances via firewall rules limiting exposure to trusted IP ranges. Review web server access logs for suspicious requests containing traversal sequences (../ or URL-encoded equivalents) targeting /static, /css, /js endpoints. Full advisory and patch details: https://github.com/aces/Loris/security/advisories/GHSA-rfj5-58hv-wc5f

Affected VersionsENISA

Loris 28.0.0, < 28.0.1

Loris 20.0.0, < 27.0.3

Affected Packages

euvd loris_20_0_0 fix: 27.0.3

euvd loris_28_0_0 fix: 28.0.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Directory traversal flaw in static file routing logic fails to sanitize path parameters, allowing '../' sequences to escape document root boundaries. CWE-552 (externally accessible file/directory) combined with absent input validation on file path construction. CVSS vector PR:N confirms unauthenticated exploitation over network without user interaction.

Know when Loris gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

28.0.1,27.0.3

CVE Published

Apr 08, 2026 - 17:57 nvd

HIGH 7.5

DescriptionCVE.org

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.

Executive ViewAI

Why It Matters

LORIS neuroimaging platform versions 20.0.0-27.0.2 and 28.0.0 contain an unauthenticated path traversal vulnerability allowing attackers to download arbitrary files from affected servers, creating immediate risk of exposure of sensitive research data, credentials, and system configurations. Any organization operating self-hosted LORIS installations in clinical or academic research environments faces potential breach of protected health information and research intellectual property without urgent remediation.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not possible: implement network-level access controls to restrict external connectivity to LORIS static file router endpoints (/static, /css, /js); disable or relocate static file serving if functionally feasible; deploy web application firewall rules to block path traversal patterns (../, encoded variants) in request URIs targeting static endpoints; implement strict file system permissions to prevent sensitive files (configuration, credentials) from residing in directories served by the static router.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.