EUVD-2026-20574Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious link with unsanitized input
-
ExploitTrick authenticated user into clicking link
-
ExecutionExecute reflected XSS in help_editor module
-
ImpactSteal session tokens or download arbitrary markdown files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | LORIS versions before 27.0.3 and 28.0.1 with help_editor module enabled. Requires authenticated user access (PR:L). Victim must click attacker-crafted link. Enables reflected XSS and arbitrary markdown file download. |
| Impact | CVSS 8.7 reflects high impact (confidentiality, integrity) via authenticated XSS and arbitrary file download in help_editor module. Unauthenticated attackers cannot directly exploit; requires authenticated user tricked into malicious link. EPSS pending. Self-hosted neuroimaging systems face moderate risk depending on deployment scope and user base exposure. |
| Exploit ScenarioDerived | Authenticated attacker crafts malicious link containing unsanitized payload targeting help_editor module. Victim clicks link, triggering reflected XSS or arbitrary markdown file download. No public exploit code identified at time of analysis; requires social engineering component. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Reflected cross-site scripting and arbitrary markdown file download in LORIS help_editor module affects versions prior to 27.0.3 and 28.0.1. Improper input sanitization allows authenticated attackers with low privileges to execute malicious scripts in victim browsers (requiring user interaction) and exfiltrate markdown files from the server. Attack requires network access and social engineering to trick users into following crafted links. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade to LORIS version 27.0.3 for 27.x deployments or 28.0.1 for 28.x deployments, which implement proper input sanitization in the help_editor module. Consult the official security advisory at https://github.com/aces/Loris/security/advisories/GHSA-j2p3-58m2-v6q3 for upgrade instructions and additional context. If immediate patching is not feasible, restrict access to the help_editor module to only trusted administrative users, implement web application firewall rules to detect reflected XSS patterns in help_editor parameters, and audit markdown file permissions to prevent unauthorized access. Deploy Content Security Policy headers to mitigate XSS execution impact as a defense-in-depth measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 reflected XSS stems from insufficient input validation in help_editor module user-supplied variables. Dual exploitation path: malicious payloads reflect into HTML responses causing script execution, while same injection vector enables path traversal to retrieve arbitrary markdown files. CVSS vector PR:L indicates authenticated context; UI:R confirms social engineering dependency. Scope change (S:C) reflects cross-domain impact potential.
Know when Loris gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.
Executive ViewAI
CVE-2026-35169 affects the LORIS help_editor module, allowing authenticated attackers to inject malicious scripts into victim browsers and download sensitive markdown files from the server. Organizations running LORIS versions prior to 27.0.3 or 28.0.1 face risk of data exfiltration and potential credential compromise through reflected XSS, requiring immediate patching to prevent social engineering-driven attacks.
Apply vendor patch. Until patching is complete: (1) restrict network access to LORIS help_editor module via WAF or access control lists to only authorized internal networks; (2) implement email security controls to block phishing links targeting LORIS help_editor URLs; (3) disable the help_editor module if operationally feasible; (4) enforce security awareness training emphasizing avoidance of suspicious links within LORIS.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote code execution in LORIS neuroimaging platform allows authenticated users with sufficient privileges to bypass pat
Path traversal in LORIS neuroimaging research platform versions 24.0.0 through 27.0.2 and 28.0.0 allows authenticated at
Authenticated users in LORIS 24.0.0 through 28.0.0 can exploit a path traversal vulnerability to read arbitrary configur
SQL injection in LORIS neuroimaging research platform versions prior to 27.0.3 and 28.0.1 enables unauthenticated remote
Path traversal in LORIS neuroimaging research platform (versions 20.0.0 through 27.0.2 and 28.0.0) enables unauthenticat
LORIS (Longitudinal Online Research and Imaging System) versions 16.1.0 through 27.0.2 and 28.0.0 allow authenticated us
LORIS versions 21.0.0 through 27.0.2 and 28.0.0 suffer from broken access control in the document_repository backend end
Missing authorization checks in the LORIS imaging_browser API allow any authenticated API caller to modify imaging data
Open redirect vulnerability in LORIS (Longitudinal Online Research and Imaging System) versions prior to 27.0.3 and 28.0
Cross-site scripting (XSS) in LORIS survey_accounts module (versions 15.10 through 27.0.2 and 28.0.0) allows authenticat
LORIS deployments running the Issue Tracker module expose a missing-authorization flaw in which the backend edit endpoin
LORIS (Longitudinal Online Research and Imaging System) versions 20.0.0 through 27.0.2 and 28.0.0 allow authenticated us
Exploit-DB