CVE-2026-26984 - Vulnerability Analysis

Overview

LORIS < 26.0.5, < 27.0.2, < 28.0.0 contains a path traversal vulnerability caused by improper file upload handling in the media module, letting authenticated users with privileges upload malicious files and achieve remote code execution, exploit requires appropriate user permissions.

Severity & Score

Impact

Authenticated attackers with privileges can upload malicious files and execute code remotely, potentially compromising the server.

Mitigation

Upgrade to LORIS v26.0.5, v27.0.2, v28.0.0 or later; alternatively, disable the media module if unused.

References

• https://github.com/aces/Loris/releases/tag/v26.0.5
• https://github.com/aces/Loris/releases/tag/v27.0.2
• https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2h

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner