PT-2026-31430 · Loris · Loris

CVE-2026-35446 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LORIS versions 24.0.0 through 27.0.2 and 28.0.0

Description LORIS is a self-hosted web application used for data and project management in neuroimaging research. An incorrect order of operations within the FilesDownloadHandler could allow an attacker to escape intended download directories.

Recommendations Update to version 27.0.3 or 28.0.1.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2026-35446

GHSA-47JJ-7XFG-8759

Affected Products

Loris

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35446.json · Exploit
• https://github.com/aces/Loris/security/advisories/GHSA-47jj-7xfg-8759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35446 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35446 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2042026706538541285 · Twitter Post
• https://twitter.com/CVEnew/status/2041975585497346227 · Twitter Post