LORIS is a self-hosted web application for neuroimaging research data management. Versions prior to 27.0.3 and between 28.0.0 and 28.0.1 contain a reflected XSS vulnerability in the help_editor module due to improper sanitization of user input. This vulnerability allows attackers to execute arbitrary scripts in the context of a victim's browser when the victim follows a crafted link. Furthermore, the same input flaw can be exploited to download arbitrary markdown files from the server. The issue is addressed in versions 27.0.3 and 28.0.1 of LORIS.

Successful exploitation can lead to high impact including execution of arbitrary scripts in the victim's browser, potentially resulting in credential theft, session hijacking, or other malicious actions. Additionally, unauthorized download of markdown files could lead to information disclosure. There is no indication of denial of service or system-level compromise. No known exploits have been reported in the wild.

This vulnerability is fixed in LORIS versions 27.0.3 and 28.0.1. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed by a vendor advisory in the provided data, but the description states the issue is fixed in these versions. No additional mitigation steps are indicated.