PT-2026-22019 · Loris · Loris

Guillaume Pillot + 1 · Publicado 2026-02-25 · Atualizado 2026-03-05 · CVE-2026-26984

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LORIS versions prior to 26.0.5 LORIS versions prior to 27.0.2 LORIS versions prior to 28.0.0

Description LORIS is a self-hosted web application used for data and project management in neuroimaging research. An authenticated user with sufficient privileges can exploit a path traversal flaw to upload a malicious file to an arbitrary location on the server. Successful exploitation could lead to remote code execution (RCE). If the server is configured as read-only, RCE is not possible, but malicious file upload may still be achievable. The issue involves the ability to upload files via a path traversal, potentially impacting the server's integrity.

Recommendations Update LORIS to version 26.0.5 or later. Update LORIS to version 27.0.2 or later. Update LORIS to version 28.0.0 or later. If the media module is not in use, disable it as a workaround.

Exploit

Correção

RCE

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-22

Identificadores relacionados

CVE-2026-26984

GHSA-MPGC-C48M-6V2H

Produtos afetados

Loris

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26984.json · Exploit
• https://github.com/aces/Loris/releases/tag/v26.0.5 · Nota
• https://github.com/aces/Loris/releases/tag/v27.0.2 · Nota
• https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027099266490220831 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026855237089210852 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26984 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26984 · Aviso do Fabricante
• https://t.me/cveNotify/154359 · Publicação no Telegram