CVE-2026-34392 is a directory traversal vulnerability (CWE-552) in the static file router of aces LORIS versions >= 20.0.0 and < 27.0.3, and >= 28.0.0 and < 28.0.1. The vulnerability allows an unauthenticated attacker to access files outside the intended static directories by exploiting insufficient path validation in static, css, and js endpoints. This can lead to unauthorized disclosure of sensitive files. The issue is resolved in versions 27.0.3 and 28.0.1.

Successful exploitation allows an attacker to read arbitrary files accessible to the application outside the intended static directories, potentially exposing sensitive data. The vulnerability does not allow modification or denial of service. The CVSS score of 7.5 reflects high confidentiality impact with no integrity or availability impact. There are no known exploits in the wild at this time.

Users should upgrade affected LORIS instances to version 27.0.3 or 28.0.1 or later, where the vulnerability is fixed. Since LORIS is self-hosted, patching is the primary remediation. No vendor advisory indicates alternative mitigations or that no action is required.