CVE-2026-26984
Published: 25 February 2026
Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can exploit a path traversal vulnerability to…
more
upload a malicious file to an arbitrary location on the server. Once uploaded, the file can be used to achieve remote code execution (RCE). An attacker must be authenticated and have the appropriate permissions to exploit this issue. If the server is configured as read-only, remote code execution (RCE) is not possible; however, the malicious file upload may still be achievable. This problem is fixed in LORIS v26.0.5 and above, v27.0.2 and above, and v28.0.0 and above. As a workaround, LORIS administrators can disable the media module if it is not being used.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates path traversal by validating uploaded file paths to confine them to authorized directories, preventing arbitrary file placement.
Enforces least functionality by disabling the unused media module, eliminating the vulnerable upload capability as recommended in the workaround.
Requires timely flaw remediation through patching to versions 26.0.5, 27.0.2, or 28.0.0 that fix the path traversal vulnerability.
Security SummaryAI
CVE-2026-26984 is a path traversal vulnerability (CWE-22, CWE-434) in LORIS, a self-hosted web application for data and project management in neuroimaging research. It affects versions prior to 26.0.5, 27.0.2, and 28.0.0, enabling an authenticated user with sufficient privileges to upload a malicious file to an arbitrary location on the server. This can lead to remote code execution (RCE) once the file is in place. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker must be authenticated and possess the appropriate permissions to exploit this issue, targeting the media module. By leveraging the path traversal, they can place a malicious file anywhere on the server filesystem, potentially executing arbitrary code if the server processes it. In read-only configurations, RCE is prevented, though arbitrary file upload remains feasible.
The vulnerability is fixed in LORIS versions 26.0.5 and later, 27.0.2 and later, and 28.0.0 and later. As a workaround, administrators can disable the media module if it is not required. Details are available in the GitHub security advisory (GHSA-mpgc-c48m-6v2h) and release notes for the patched versions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in a self-hosted web application enables authenticated users to upload malicious files to arbitrary server locations, leading to RCE, directly facilitating exploitation of public-facing applications.