CVE-2026-35169: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in aces Loris
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.
AI Analysis
Technical Summary
LORIS is a self-hosted neuroimaging research data management web application. In affected versions, the help_editor module fails to properly neutralize user input during web page generation, leading to a reflected XSS vulnerability (CWE-79). This improper input sanitization also allows unauthorized downloading of markdown files (CWE-552). The vulnerability is addressed in versions 27.0.3 and 28.0.1 of LORIS.
Potential Impact
Successful exploitation can lead to reflected cross-site scripting attacks, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to credential theft or session hijacking. The ability to download arbitrary markdown files could expose sensitive information stored on the server. The CVSS 3.1 base score is 8.7, indicating high severity with network attack vector, low attack complexity, required privileges of low, user interaction required, and high impact on confidentiality and integrity but no impact on availability.
Mitigation Recommendations
A fix is available in LORIS versions 27.0.3 and 28.0.1. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a self-hosted application, administrators must apply these updates manually. Patch status is confirmed by the vendor's versioning information in the advisory.
CVE-2026-35169: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in aces Loris
Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LORIS is a self-hosted neuroimaging research data management web application. In affected versions, the help_editor module fails to properly neutralize user input during web page generation, leading to a reflected XSS vulnerability (CWE-79). This improper input sanitization also allows unauthorized downloading of markdown files (CWE-552). The vulnerability is addressed in versions 27.0.3 and 28.0.1 of LORIS.
Potential Impact
Successful exploitation can lead to reflected cross-site scripting attacks, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to credential theft or session hijacking. The ability to download arbitrary markdown files could expose sensitive information stored on the server. The CVSS 3.1 base score is 8.7, indicating high severity with network attack vector, low attack complexity, required privileges of low, user interaction required, and high impact on confidentiality and integrity but no impact on availability.
Mitigation Recommendations
A fix is available in LORIS versions 27.0.3 and 28.0.1. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a self-hosted application, administrators must apply these updates manually. Patch status is confirmed by the vendor's versioning information in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-01T17:26:21.133Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d736f91cc7ad14da418a5a
Added to database: 4/9/2026, 5:19:53 AM
Last enriched: 4/9/2026, 5:20:57 AM
Last updated: 4/10/2026, 7:30:47 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.