CVE-2026-35165: falha de média gravidade em aces Loris
LORIS has incorrect access checks in document_repository
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.2%
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the document_repository frontend was restricting file access, the backend endpoint was not correctly verifying access permissions. A user could theoretically download a file that they should not have access to, if they know or can brute force the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
aces · LorisCVEs relacionadas — aces Loris
No mesmo produto, das mais perigosas para as menos.
CVE-2026-26984HIGHLORIS media module vulnerable to remote code executionEPSS 0.8%CVE-2026-26985HIGHLORIS vulnerable to path traversal in electrophysiology_browserEPSS 0.4%CVE-2026-34392HIGHLORIS has a path traversal in static routerEPSS 0.3%CVE-2026-33350HIGHLORIS has a SQL injection in MRI feedback popupEPSS 0.3%CVE-2026-35446HIGHLORIS has a path traversal in FilesDownloadHandlerEPSS 0.2%CVE-2026-34985MEDIUMLORIS has incorrect access checks in media moduleEPSS 0.2%