PT-2026-31425 · Loris · Loris

Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-34985

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LORIS versions 16.1.0 through 27.0.2 and 28.0.0

Description The LORIS application, used for data and project management in neuroimaging research, had a flaw where backend access checks were missing for files. This allowed unauthorized access to files if the filename was known, despite frontend filtering.

Recommendations Update to version 27.0.3 or 28.0.1

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-34985

Affected Products

Loris

References · 4

• https://github.com/aces/Loris/security/advisories/GHSA-p42c-4gmq-hrjw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34985 · Security Note
• https://twitter.com/VulmonFeeds/status/2042039504014291303 · Twitter Post
• https://twitter.com/CVEnew/status/2041975592350847130 · Twitter Post