CVE-2026-26985 - Vulnerability Analysis

Overview

LORIS 24.0.0 to before 26.0.5, 27.0.2, and 28.0.0 contains a path traversal caused by improper validation in electrophysiogy_browser module, letting authenticated users with permissions read configuration files containing hard-coded credentials.

Severity & Score

Impact

Authenticated attackers can read sensitive configuration files, potentially leading to credential compromise and unauthorized access to database or services.

Mitigation

Upgrade to version 26.0.5, 27.0.2, 28.0.0 or later. Alternatively, disable electrophysiogy_browser module as a workaround.

References

• https://github.com/aces/Loris/security/advisories/GHSA-g3pp-rqvq-xxhp
• https://github.com/aces/Loris/releases/tag/v26.0.5
• https://github.com/aces/Loris/releases/tag/v27.0.2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner