CVE-2026-34392CWE-552

LORIS has a path traversal in static router

High · published April 8, 2026

CVSS v3.1

7.5

EPSS

Percentile

34.8

In the wild

Unconfirmed

What it is

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00416 · 34.8th percentile
Weakness: CWE-552 · Files or Directories Accessible to External Parties
Published: 2026-04-08T17:57Z

EPSS history

Timeline

08 APR 17:57Z
LORIS has a path traversal in static router
cvelistv5