LORIS Reflected Cross-Site Scripting Vulnerability (CVE-2026-35169)

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application used for data and project management in neuroimaging research. Versions prior to 27.0.3 and 28.0.1 contain a reflected cross-site scripting (XSS) vulnerability (CVE-2026-35169) in the help_editor module. The vulnerability stems from the module's failure to properly sanitize user-supplied variables. An attacker could exploit this by crafting a malicious link and tricking a user into clicking it, leading to arbitrary script execution in the user's browser. Additionally, the same input vector can be leveraged to download arbitrary markdown files from the unpatched server. Organizations using LORIS should upgrade to version 27.0.3 or 28.0.1 to remediate this risk.

Attack Chain

1. Attacker identifies a vulnerable LORIS instance running a version prior to 27.0.3 or 28.0.1.
2. Attacker crafts a malicious URL containing a JavaScript payload in a parameter processed by the help_editor module. The payload could be designed to steal cookies, redirect the user, or deface the web page.
3. The attacker distributes the malicious URL to a target user via email, social media, or other means.
4. The target user, believing the link to be legitimate, clicks on the malicious URL.
5. The user's browser sends a request to the LORIS server, including the malicious JavaScript payload as a parameter.
6. The LORIS server's help_editor module fails to properly sanitize the user-supplied input.
7. The server reflects the unsanitized JavaScript payload back to the user's browser within the HTML response.
8. The user's browser executes the malicious JavaScript code, enabling the attacker to perform actions within the context of the user's session or download arbitrary markdown files.

Impact

Successful exploitation of the XSS vulnerability (CVE-2026-35169) in LORIS could lead to various detrimental outcomes. An attacker could steal sensitive user session cookies, potentially gaining unauthorized access to the LORIS application and associated data. The attacker could also deface the LORIS website, redirect users to phishing pages, or perform other malicious actions within the user's browser. Furthermore, the ability to download arbitrary markdown files can expose sensitive documentation or configuration details stored on the server, potentially aiding further attacks. Given LORIS's use in managing neuroimaging research data, a successful attack could compromise sensitive patient or research information.

Recommendation

• Immediately upgrade LORIS to version 27.0.3 or 28.0.1 to patch CVE-2026-35169 and prevent exploitation of the XSS vulnerability.
• Deploy the provided Sigma rule to your SIEM to detect attempts to exploit the XSS vulnerability in the LORIS help_editor module.
• Implement input validation and output encoding in the help_editor module to prevent XSS vulnerabilities in the future.