PT-2026-31427 · Loris · Loris

Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-35169

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LORIS versions prior to 27.0.3 and version 28.0.1

Description The LORIS application does not properly sanitize user-supplied variables within the help editor module, potentially leading to a reflected cross-site scripting attack if a user is tricked into following a malicious link. This could also allow an attacker to download arbitrary markdown files from an unpatched server.

Recommendations Update to version 27.0.3 or 28.0.1

Fix

XSS

Files Accessible to External Parties

Weakness Enumeration

CWE-79

CWE-552

Related Identifiers

CVE-2026-35169

Affected Products

Loris

References · 5

• https://github.com/aces/Loris/security/advisories/GHSA-j2p3-58m2-v6q3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35169 · Security Note
• https://twitter.com/CveFindCom/status/2042093535260798989 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042034384430104710 · Twitter Post
• https://twitter.com/CVEnew/status/2041975589670727749 · Twitter Post