CVE-2026-35400

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35400", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T17:03:42.074Z", "datePublished": "2026-04-08T18:26:09.890Z", "dateUpdated": "2026-04-08T19:52:33.071Z"}, "containers": {"cna": {"title": "LORIS incorrectly trusts user input in publication module", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/aces/Loris/security/advisories/GHSA-6prw-34x8-3gpg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-6prw-34x8-3gpg"}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"version": ">= 20.0.0, < 27.0.3", "status": "affected"}, {"version": ">= 28.0.0, < 28.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T18:26:09.890Z"}, "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS. This vulnerability is fixed in 27.0.3 and 28.0.1."}], "source": {"advisory": "GHSA-6prw-34x8-3gpg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T19:52:25.879615Z", "id": "CVE-2026-35400", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:52:33.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:52:25.879615Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:52:30.410Z"}}], "cna": {"title": "LORIS incorrectly trusts user input in publication module", "source": {"advisory": "GHSA-6prw-34x8-3gpg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "aces", "product": "Loris", "versions": [{"status": "affected", "version": ">= 20.0.0, < 27.0.3"}, {"status": "affected", "version": ">= 28.0.0, < 28.0.1"}]}], "references": [{"url": "https://github.com/aces/Loris/security/advisories/GHSA-6prw-34x8-3gpg", "name": "https://github.com/aces/Loris/security/advisories/GHSA-6prw-34x8-3gpg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS. This vulnerability is fixed in 27.0.3 and 28.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-08T18:26:09.890Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35400", "state": "PUBLISHED", "dateUpdated": "2026-04-08T19:52:33.071Z", "dateReserved": "2026-04-02T17:03:42.074Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-08T18:26:09.890Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Loris", "vendor": "aces", "versions": [{"status": "affected", "version": ">= 20.0.0, < 27.0.3"}, {"status": "affected", "version": ">= 28.0.0, < 28.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*", "matchCriteriaId": "91166D84-04DC-4603-8E1B-ADE86AB22608", "versionEndIncluding": "27.0.2", "versionStartIncluding": "20.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcgill:loris:28.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D358B66A-04AC-44F2-8EF6-4332D8AC00F4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS. This vulnerability is fixed in 27.0.3 and 28.0.1."}, {"lang": "es", "value": "LORIS (Longitudinal Online Research and Imaging System) es una aplicaci\u00f3n web autoalojada que proporciona gesti\u00f3n de datos y proyectos para la investigaci\u00f3n en neuroimagen. Desde 20.0.0 hasta antes de 27.0.3 y 28.0.1, un endpoint en el m\u00f3dulo de publicaci\u00f3n estaba confiando incorrectamente en la baseURL enviada por una solicitud POST de un usuario en lugar del valor interno de LORIS. Esto podr\u00eda resultar en que un atacante te\u00f3rico con acceso al m\u00f3dulo de publicaci\u00f3n falsificara un correo electr\u00f3nico a un dominio externo bajo el control del atacante que pareciera provenir de LORIS. Esta vulnerabilidad est\u00e1 corregida en 27.0.3 y 28.0.1."}], "id": "CVE-2026-35400", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35400", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T19:52:25.879615Z", "version": "2.0.3"}}]}, "published": "2026-04-08T19:25:23.590", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/aces/Loris/security/advisories/GHSA-6prw-34x8-3gpg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[20.0.0,27.0.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[28.0.0,28.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Loris", "source": "cna", "vendor": "aces"}, "product": "loris", "vendor": "aces"}], "analysis": {"en": {"generated_at": "2026-04-08T21:35:33.784677+00:00", "value": {"mitigation_remediation": ["Verify your LORIS installation falls between 20.0.0 and 27.0.2 or is exactly 28.0.0 to determine if it is vulnerable.", "Upgrade to LORIS 27.0.3 or later, or to 28.0.1 and newer, where the baseURL validation bug is fixed.", "If an upgrade cannot be performed immediately, restrict publication module access to trusted users only and monitor outbound SMTP traffic for any messages that appear to originate from LORIS but are directed to unknown domains.", "Periodically review outbound email logs for anomalous domains or spoofed sender addresses.", "Provide staff training on recognizing phishing emails that appear to originate from the application."], "summary": {"action": "Patch immediately", "impact": "Email spoofing via forged baseURL"}, "threat_synthesis": {"affected_systems": "LORIS versions from 20.0.0 up to, but not including, 27.0.3 and the 28.0.0 release are vulnerable. The fix is available in 27.0.3 and in 28.0.1 and later releases.", "description_and_impact": "The publication module in the web application accepts a user\u2011supplied baseURL from a POST request instead of the internally configured value. This flaw allows an attacker with access to the publication module to direct automated emails to an external domain of the attacker\u2019s choosing. The resulting emails will appear to originate from the application, enabling phishing or social\u2011engineering attacks against internal users. The weakness corresponds to CWE\u201159, where untrusted input influences address resolution.", "risk_and_exploitability": "The CVSS score of 3.5 indicates low severity, and no EPSS data is available; the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires that an attacker first obtain authenticated access to the publication module, which typically means having valid user credentials or the ability to create a publication. Once such access is achieved, the attacker can modify the baseURL to send spoofed emails. The risk is confined to environments where users trust emails sent from the application; exploitation without user interaction is unlikely, but the potential for phishing remains."}}}}, "created": "2026-04-09T08:18:26.082846+00:00", "updated": "2026-04-09T08:27:48.437157+00:00", "vendors": ["aces", "aces$PRODUCT$loris"]}