CVE-2026-26984

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26984", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T01:41:24.605Z", "datePublished": "2026-02-25T21:15:54.790Z", "dateUpdated": "2026-02-25T21:42:13.721Z"}, "containers": {"cna": {"title": "LORIS media module vulnerable to remote code execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}}], "references": [{"name": "https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h"}, {"name": "https://github.com/aces/Loris/releases/tag/v26.0.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/releases/tag/v26.0.5"}, {"name": "https://github.com/aces/Loris/releases/tag/v27.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/releases/tag/v27.0.2"}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"version": "< 26.0.5", "status": "affected"}, {"version": ">= 27.0.0, < 27.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T21:15:54.790Z"}, "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can exploit a path traversal vulnerability to upload a malicious file to an arbitrary location on the server. Once uploaded, the file can be used to achieve remote code execution (RCE). An attacker must be authenticated and have the appropriate permissions to exploit this issue. If the server is configured as read-only, remote code execution (RCE) is not possible; however, the malicious file upload may still be achievable. This problem is fixed in LORIS v26.0.5 and above, v27.0.2 and above, and v28.0.0 and above. As a workaround, LORIS administrators can disable the media module if it is not being used."}], "source": {"advisory": "GHSA-mpgc-c48m-6v2h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T21:42:06.124395Z", "id": "CVE-2026-26984", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:42:13.721Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26984", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T21:42:06.124395Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:42:10.145Z"}}], "cna": {"title": "LORIS media module vulnerable to remote code execution", "source": {"advisory": "GHSA-mpgc-c48m-6v2h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"status": "affected", "version": "< 26.0.5"}, {"status": "affected", "version": ">= 27.0.0, < 27.0.2"}]}], "references": [{"url": "https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h", "name": "https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/aces/Loris/releases/tag/v26.0.5", "name": "https://github.com/aces/Loris/releases/tag/v26.0.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/aces/Loris/releases/tag/v27.0.2", "name": "https://github.com/aces/Loris/releases/tag/v27.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can exploit a path traversal vulnerability to upload a malicious file to an arbitrary location on the server. Once uploaded, the file can be used to achieve remote code execution (RCE). An attacker must be authenticated and have the appropriate permissions to exploit this issue. If the server is configured as read-only, remote code execution (RCE) is not possible; however, the malicious file upload may still be achievable. This problem is fixed in LORIS v26.0.5 and above, v27.0.2 and above, and v28.0.0 and above. As a workaround, LORIS administrators can disable the media module if it is not being used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T21:15:54.790Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26984", "state": "PUBLISHED", "dateUpdated": "2026-02-25T21:42:13.721Z", "dateReserved": "2026-02-17T01:41:24.605Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T21:15:54.790Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Loris", "vendor": "aces", "versions": [{"status": "affected", "version": "< 26.0.5"}, {"status": "affected", "version": ">= 27.0.0, < 27.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*", "matchCriteriaId": "B143A02C-B7A7-48AB-BB97-804A089C1081", "versionEndExcluding": "26.0.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1883C04-6846-427A-BFFE-4C3AF35CCC19", "versionEndExcluding": "27.0.2", "versionStartIncluding": "27.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can exploit a path traversal vulnerability to upload a malicious file to an arbitrary location on the server. Once uploaded, the file can be used to achieve remote code execution (RCE). An attacker must be authenticated and have the appropriate permissions to exploit this issue. If the server is configured as read-only, remote code execution (RCE) is not possible; however, the malicious file upload may still be achievable. This problem is fixed in LORIS v26.0.5 and above, v27.0.2 and above, and v28.0.0 and above. As a workaround, LORIS administrators can disable the media module if it is not being used."}, {"lang": "es", "value": "LORIS (Longitudinal Online Research and Imaging System) es una aplicaci\u00f3n web autoalojada que proporciona gesti\u00f3n de datos y proyectos para la investigaci\u00f3n en neuroimagen. Antes de las versiones 26.0.5, 27.0.2 y 28.0.0, un usuario autenticado con privilegios suficientes puede explotar una vulnerabilidad de salto de ruta para cargar un archivo malicioso en una ubicaci\u00f3n arbitraria en el servidor. Una vez cargado, el archivo puede usarse para lograr la ejecuci\u00f3n remota de c\u00f3digo (RCE). Un atacante debe estar autenticado y tener los permisos apropiados para explotar este problema. Si el servidor est\u00e1 configurado como de solo lectura, la ejecuci\u00f3n remota de c\u00f3digo (RCE) no es posible; sin embargo, la carga del archivo malicioso a\u00fan puede ser factible. Este problema est\u00e1 solucionado en LORIS v26.0.5 y superiores, v27.0.2 y superiores, y v28.0.0 y superiores. Como soluci\u00f3n alternativa, los administradores de LORIS pueden deshabilitar el m\u00f3dulo de medios si no se est\u00e1 utilizando."}], "id": "CVE-2026-26984", "lastModified": "2026-06-17T10:26:29.217", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26984", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T21:42:06.124395Z", "version": "2.0.3"}}]}, "published": "2026-02-25T22:16:24.173", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/aces/Loris/releases/tag/v26.0.5"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/aces/Loris/releases/tag/v27.0.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[27.0.0,27.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Loris", "source": "cna", "vendor": "aces"}, "product": "loris", "vendor": "aces"}], "analysis": {"en": {"generated_at": "2026-04-17T14:49:39.239833+00:00", "value": {"mitigation_remediation": ["Upgrade LORIS to version 26.0.5 or later, 27.0.2 or later, or 28.0.0 or later, whichever applies to your installation.", "If an upgrade cannot be performed immediately, disable the media module in the LORIS configuration or uninstall it completely.", "Reduce permissions for users, ensuring that only trusted administrators have the ability to upload files, and consider setting the application to read\u2011only mode if file uploads are unnecessary."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "McGill's LORIS, a self\u2011hosted web platform for neuroimaging research, is affected. Versions older than 26.0.5, 27.0.2, and 28.0.0 contain the flaw. The application relies on the media module to manage project files, so any deployment of these versions that enables the module is vulnerable unless the module has been disabled or the system is run in read\u2011only mode.", "description_and_impact": "The vulnerability originates from a path\u2011traversal flaw in LORIS's media module that allows an authenticated user with sufficient privileges to upload a file to any directory on the server. Because the application does not sanitize the supplied path, a malicious file can be placed on the filesystem and later executed, providing remote code execution on the host. The flaw also permits unrestricted file uploads, which can be abused even if the server is set to read\u2011only, although RCE would be blocked in that scenario.", "risk_and_exploitability": "The CVSS base score of 8.8 indicates high severity, while the EPSS score below 1% suggests a low probability of exploitation at present. Nevertheless, the attack requires only authentication and appropriate upload rights, which are normally granted to project administrators. An attacker who gains such access can leverage the flaw to run code, compromise data integrity, and potentially pivot to other systems. The issue is not listed in the CISA KEV catalog, but the combination of authenticated access and unrestricted file placement makes it a serious risk for any LORIS installation that has the media module enabled."}}}}, "created": "2026-02-26T13:10:55.793542+00:00", "updated": "2026-04-17T15:00:11.015251+00:00", "vendors": ["aces", "aces$PRODUCT$loris"]}