« Volver al listado

CVE-2026-34985

Estado: AnalizadaMedia (6.5)—

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would be possible for someone who should not have access to a file to access it if they know the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcgill — Loris

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-34985",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34985",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-10T20:41:34.403861Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "aces",
          "product": "Loris",
          "versions": [
            {
              "status": "affected",
              "version": ">= 16.1.0, < 27.0.3"
            },
            {
              "status": "affected",
              "version": ">= 28.0.0, < 28.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-08T19:25:23.157",
  "references": [
    {
      "url": "https://github.com/aces/Loris/security/advisories/GHSA-p42c-4gmq-hrjw",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would be possible for someone who should not have access to a file to access it if they know the filename. This vulnerability is fixed in 27.0.3 and 28.0.1."
    },
    {
      "lang": "es",
      "value": "LORIS (Longitudinal Online Research and Imaging System) es una aplicación web autoalojada que proporciona gestión de datos y proyectos para la investigación en neuroimagen. Desde la versión 16.1.0 hasta antes de las versiones 27.0.3 y 28.0.1, aunque el frontend del módulo de medios filtra los archivos a los que el usuario no debería tener acceso, el backend no estaba aplicando comprobaciones de acceso y sería posible que alguien que no debería tener acceso a un archivo lo accediera si conocía el nombre del archivo. Esta vulnerabilidad está corregida en las versiones 27.0.3 y 28.0.1."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F804E5A-C679-411E-AA44-8CDEEC883F11",
              "versionEndIncluding": "27.0.2",
              "versionStartIncluding": "16.1.0"
            },
            {
              "criteria": "cpe:2.3:a:mcgill:loris:28.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D358B66A-04AC-44F2-8EF6-4332D8AC00F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}