PT-2026-22019 · Loris · Loris

Guillaume Pillot + 1 · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-26984

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LORIS versions prior to 26.0.5 LORIS versions prior to 27.0.2 LORIS versions prior to 28.0.0

Description LORIS is a self-hosted web application used for data and project management in neuroimaging research. An authenticated user with sufficient privileges can exploit a path traversal flaw to upload a malicious file to an arbitrary location on the server. Successful exploitation could lead to remote code execution (RCE). If the server is configured as read-only, RCE is not possible, but malicious file upload may still be achievable. The issue involves the ability to upload files via a path traversal, potentially impacting the server's integrity.

Recommendations Update LORIS to version 26.0.5 or later. Update LORIS to version 27.0.2 or later. Update LORIS to version 28.0.0 or later. If the media module is not in use, disable it as a workaround.

Exploit

Fix

RCE

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2026-26984

GHSA-MPGC-C48M-6V2H

Affected Products

Loris

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26984.json · Exploit
• https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26984 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26984 · Vendor Advisory
• https://github.com/aces/Loris/releases/tag/v26.0.5 · Note
• https://github.com/aces/Loris/releases/tag/v27.0.2 · Note
• https://twitter.com/CVEnew/status/2027099266490220831 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026855237089210852 · Twitter Post
• https://t.me/cveNotify/154359 · Telegram Post