CVE-2026-26985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26985", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T01:41:24.606Z", "datePublished": "2026-02-25T21:26:00.201Z", "dateUpdated": "2026-02-25T21:39:45.355Z"}, "containers": {"cna": {"title": "LORIS vulnerable to path traversal in electrophysiology_browser", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp"}, {"name": "https://github.com/aces/Loris/releases/tag/v26.0.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/releases/tag/v26.0.5"}, {"name": "https://github.com/aces/Loris/releases/tag/v27.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/aces/Loris/releases/tag/v27.0.2"}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"version": ">= 24.0.0, < 26.0.5", "status": "affected"}, {"version": ">= 27.0.0, < 27.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T21:26:00.201Z"}, "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager."}], "source": {"advisory": "GHSA-g3pp-rqvq-xxhp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T21:38:48.956284Z", "id": "CVE-2026-26985", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:39:45.355Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-25T21:38:48.956284Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:39:39.147Z"}}], "cna": {"title": "LORIS vulnerable to path traversal in electrophysiology_browser", "source": {"advisory": "GHSA-g3pp-rqvq-xxhp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"status": "affected", "version": ">= 24.0.0, < 26.0.5"}, {"status": "affected", "version": ">= 27.0.0, < 27.0.2"}]}], "references": [{"url": "https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp", "name": "https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/aces/Loris/releases/tag/v26.0.5", "name": "https://github.com/aces/Loris/releases/tag/v26.0.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/aces/Loris/releases/tag/v27.0.2", "name": "https://github.com/aces/Loris/releases/tag/v27.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T21:26:00.201Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26985", "state": "PUBLISHED", "dateUpdated": "2026-02-25T21:39:45.355Z", "dateReserved": "2026-02-17T01:41:24.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T21:26:00.201Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Loris", "vendor": "aces", "versions": [{"status": "affected", "version": ">= 24.0.0, < 26.0.5"}, {"status": "affected", "version": ">= 27.0.0, < 27.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*", "matchCriteriaId": "97AF29D7-60B4-4DEA-9B6F-1C0D48CA5577", "versionEndExcluding": "26.0.5", "versionStartIncluding": "24.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1883C04-6846-427A-BFFE-4C3AF35CCC19", "versionEndExcluding": "27.0.2", "versionStartIncluding": "27.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager."}, {"lang": "es", "value": "LORIS (Sistema Longitudinal de Investigaci\u00f3n y Obtenci\u00f3n de Im\u00e1genes en L\u00ednea) es una aplicaci\u00f3n web autoalojada que proporciona gesti\u00f3n de datos y proyectos para la investigaci\u00f3n en neuroimagen. A partir de la versi\u00f3n 24.0.0 y antes de las versiones 26.0.5, 27.0.2 y 28.0.0, un usuario autenticado con la autorizaci\u00f3n apropiada puede leer archivos de configuraci\u00f3n en el servidor explotando una vulnerabilidad de salto de ruta. Algunos de estos archivos contienen credenciales codificadas. La vulnerabilidad permite a un atacante leer archivos de configuraci\u00f3n que contienen credenciales codificadas. El atacante podr\u00eda entonces autenticarse en la base de datos u otros servicios si esas credenciales se reutilizan. El atacante debe estar autenticado y tener los permisos requeridos. Sin embargo, la vulnerabilidad es f\u00e1cil de explotar y el c\u00f3digo fuente de la aplicaci\u00f3n es p\u00fablico. Este problema est\u00e1 solucionado en LORIS v26.0.5 y v27.0.2 y superiores, y v28.0.0 y superiores. Como soluci\u00f3n alternativa, el electrophysiogy_browser en LORIS puede ser deshabilitado por un administrador usando el gestor de m\u00f3dulos."}], "id": "CVE-2026-26985", "lastModified": "2026-06-17T10:26:29.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26985", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T21:38:48.956284Z", "version": "2.0.3"}}]}, "published": "2026-02-25T22:16:24.360", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/aces/Loris/releases/tag/v26.0.5"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/aces/Loris/releases/tag/v27.0.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.0.0,26.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[27.0.0,27.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Loris", "source": "cna", "vendor": "aces"}, "product": "loris", "vendor": "aces"}], "analysis": {"en": {"generated_at": "2026-04-18T10:33:25.716072+00:00", "value": {"mitigation_remediation": ["Upgrade LORIS to version 26.0.5 or later (for the 26.0.x branch), or to 27.0.2 or 28.0.0 or newer, to apply the official fix.", "If an upgrade cannot be performed immediately, disable the electrophysiology_browser module using the module manager to eliminate the vulnerable component.", "Review and tighten permissions so that only trusted users can access the module, reducing the risk that an authenticated attacker could exploit the path traversal."], "summary": {"action": "Patch Now", "impact": "Credential Disclosure"}, "threat_synthesis": {"affected_systems": "The issue impacts the LORIS application released by aces. Versions beginning at 24.0.0 and up to, but not including, 26.0.5, 27.0.2, and 28.0.0 are vulnerable. The patched releases are 26.0.5, 27.0.2, and 28.0.0 or later.", "description_and_impact": "This vulnerability arises from a path\u2011traversal flaw in LORIS\u2019s electrophysiology_browser module, permitting an authenticated user with sufficient privileges to read arbitrary configuration files on the server. Some of these files contain hard\u2011coded credentials that can grant access to the database or other internal services. The primary effect is the disclosure of sensitive data that could be used to compromise additional components and services.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation has not been widespread. Because the attacker must be authenticated and possess the appropriate permissions, the flaw is not openly exploitable; however, the straightforward path\u2011traversal code and publicly available source make it trivial for a determined insider or compromised account to read the files. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits yet, yet the risk remains significant if configuration files contain reused credentials. The simplest exploitation chain is: authenticated user \u2192 module access \u2192 path traversal \u2192 arbitrary file read."}}}}, "created": "2026-02-26T13:10:54.116558+00:00", "updated": "2026-04-18T10:45:43.649063+00:00", "vendors": ["aces", "aces$PRODUCT$loris"]}