Path Traversal Vulnerability in LORIS Web Application
CVE-2026-26984

8.7HIGH

Key Information:

Vendor

Aces

Status
Loris
Vendor
CVE Published:
25 February 2026

What is CVE-2026-26984?

LORIS, a self-hosted web application for neuroimaging research management, is vulnerable to a path traversal issue that may allow authenticated users to upload malicious files to unintended server locations. This vulnerability, found in versions before 26.0.5, 27.0.2, and 28.0.0, can potentially lead to remote code execution (RCE) under specific circumstances if the attacker has sufficient privileges. Although RCE is not feasible on read-only configured servers, the malicious file upload remains a concern. Users are encouraged to update to the latest versions or disable the media module if it is not used to mitigate risks.

Affected Version(s)

Loris < 26.0.5 < 26.0.5

Loris >= 27.0.0, < 27.0.2 < 27.0.0, 27.0.2

References

https://github.com/aces/Loris/security/advisories/GHSA-mp...
x_refsource_CONFIRM
https://github.com/aces/Loris/releases/tag/v26.0.5
x_refsource_MISC
https://github.com/aces/Loris/releases/tag/v27.0.2
x_refsource_MISC

CVSS V3.0

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.