PT-2026-31428 · Loris · Loris

CVE-2026-35400 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LORIS versions 20.0.0 through 27.0.2 and 28.0.0

Description The LORIS application incorrectly trusts the baseURL submitted by a user's POST request instead of its internal value within the publication module. This could allow an attacker with publication module access to forge an email appearing to originate from LORIS, directing it to a domain controlled by the attacker.

Recommendations Update to version 27.0.3 or 28.0.1

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-35400

GHSA-6PRW-34X8-3GPG

Affected Products

Loris

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35400.json · Exploit
• https://github.com/aces/Loris/security/advisories/GHSA-6prw-34x8-3gpg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35400 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35400 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041975588274020377 · Twitter Post