CVE-2026-26984
📋 TL;DR
LORIS versions before 26.0.5, 27.0.2, and 28.0.0 contain a path traversal vulnerability in the media module that allows authenticated users with sufficient privileges to upload malicious files to arbitrary server locations. This can lead to remote code execution if the server is not configured as read-only. Only authenticated users with specific permissions are affected.
💻 Affected Systems
- LORIS (Longitudinal Online Research and Imaging System)
📦 What is this software?
Loris by Mcgill
Loris by Mcgill
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker achieves remote code execution, potentially compromising the entire server and sensitive neuroimaging research data.
Likely Case
Privileged authenticated user uploads malicious file leading to server compromise or data exfiltration.
If Mitigated
File upload prevented or limited to read-only operations with no code execution.
🎯 Exploit Status
Exploitation requires authenticated access with specific permissions. Path traversal to arbitrary file upload is straightforward for privileged users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v26.0.5+, v27.0.2+, v28.0.0+
Vendor Advisory: https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h
Restart Required: Yes
Instructions:
1. Backup your LORIS installation and database. 2. Download the patched version from GitHub releases. 3. Replace the existing installation with the patched version. 4. Restart the web server and LORIS services.
🔧 Temporary Workarounds
Disable Media Module
allDisable the vulnerable media module if not required for operations.
# Disable via LORIS configuration or remove/rename media module directory
🧯 If You Can't Patch
- Implement strict access controls to limit media module permissions to minimal required users.
- Configure server as read-only to prevent remote code execution (though file upload may still be possible).
🔍 How to Verify
Check if Vulnerable:
Check LORIS version against affected ranges. Review user permissions for media module access.Check Version:
# Check LORIS version in web interface or configuration filesVerify Fix Applied:
Confirm installation of v26.0.5+, v27.0.2+, or v28.0.0+. Test media upload functionality with path traversal attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns in media module logs
- Path traversal attempts in web server logs
Network Indicators:
- HTTP POST requests to media upload endpoints with suspicious filenames
SIEM Query:
web_server_logs WHERE (uri CONTAINS '/media/' AND method='POST') AND (filename CONTAINS '../' OR filename CONTAINS '..\\')