CVE-2026-35446CWE-552

LORIS has a path traversal in FilesDownloadHandler

High · published April 8, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.2th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-04-08T18:28Z
EPSS history
Timeline
  • 08 APR 18:28Z
    LORIS has a path traversal in FilesDownloadHandler
    cvelistv5