LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application widely used for managing neuroimaging research data and projects. CVE-2026-26985 is a path traversal vulnerability classified under CWE-22 that affects LORIS versions starting from 24.0.0 up to versions prior to 26.0.5 and 27.0.2. This vulnerability allows an authenticated user with the necessary authorization to manipulate file path inputs to access restricted directories on the server. Specifically, the attacker can read configuration files that are not intended to be exposed, some of which contain hard-coded credentials for databases or other internal services. The presence of these credentials in configuration files significantly elevates the risk, as an attacker could leverage them to authenticate to backend systems, potentially leading to unauthorized data access or further system compromise. The vulnerability is easy to exploit due to the publicly available source code of LORIS, which allows attackers to understand the application’s file handling mechanisms and craft malicious requests. Exploitation requires authentication and appropriate permissions but does not require user interaction, making it a direct threat once access is gained. The vulnerability has been addressed in LORIS versions 26.0.5, 27.0.2, and 28.0.0 and later. Until patching, administrators can mitigate risk by disabling the electrophysiogy_browser module, which is the vulnerable component, via the module manager. No active exploitation has been reported in the wild as of the publication date. The CVSS v3.1 score of 8.1 indicates a high-severity issue with network attack vector, low complexity, privileges required, no user interaction, and high impact on confidentiality and integrity.

The primary impact of CVE-2026-26985 is unauthorized disclosure of sensitive configuration files containing hard-coded credentials. This can lead to credential compromise, allowing attackers to authenticate to backend databases or services, potentially resulting in data breaches, unauthorized data manipulation, or lateral movement within the affected environment. For organizations relying on LORIS for neuroimaging research data management, this could mean exposure of sensitive research data, intellectual property, or personally identifiable information (PII) of research subjects. The integrity of research data could also be compromised if attackers leverage stolen credentials to alter data or configurations. Although availability is not directly impacted, the breach of confidentiality and integrity can have severe operational and reputational consequences. Since exploitation requires authentication and specific permissions, the risk is somewhat mitigated by internal access controls; however, insider threats or compromised user accounts could easily exploit this vulnerability. The ease of exploitation and public availability of source code increase the likelihood of exploitation attempts once credentials are obtained or insider access is gained.

1. Upgrade LORIS to version 26.0.5, 27.0.2, 28.0.0, or later where the vulnerability is patched. 2. Until patching is possible, disable the electrophysiogy_browser module via the LORIS module manager to block the vulnerable functionality. 3. Review and rotate all hard-coded credentials found in configuration files to unique, strong passwords or preferably replace them with environment variables or secure vault solutions to avoid hard-coding secrets. 4. Implement strict access controls and monitoring on authenticated user accounts, especially those with permissions to access sensitive modules, to detect and prevent misuse. 5. Conduct regular audits of file access logs to identify suspicious attempts to access configuration files or other restricted resources. 6. Employ network segmentation and least privilege principles to limit the impact of compromised credentials. 7. Educate users about the importance of safeguarding credentials and monitoring for unusual activity. 8. Consider deploying web application firewalls (WAFs) with custom rules to detect and block path traversal attempts targeting LORIS endpoints.