PT-2026-31412 · Loris · Loris

CVE-2026-33350 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LORIS versions prior to 27.0.3 LORIS versions prior to 28.0.1

Description LORIS is a self-hosted web application used for data and project management in neuroimaging research. A SQL injection exists in the code sections associated with the MRI feedback popup window of the imaging browser. This allows attackers to access or modify data on the server. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized database access.

Recommendations Update to version 27.0.3. Update to version 28.0.1.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33350

GHSA-9R29-6JGC-3GGH

Affected Products

Loris

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33350.json · Exploit
• https://github.com/aces/Loris/security/advisories/GHSA-9r29-6jgc-3ggh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33350 · Security Note