CVE-2026-35446

8.6 highEPSS 0.2%

High (8.6) in mcgill loris. EPSS 0.2% chance of exploitation in the next 30 days.

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.

Severity

CVSS 3.1

8.6 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-552
Published: 2026-04-08
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

mcgill:loris

References

https://github.com/aces/Loris/security/advisories/GHSA-47jj-7xfg-8759

Check your stack JSON