CVE-2026-35169 - Vulnerability Analysis

Overview

LORIS < 27.0.3 and < 28.0.1 contains a reflected cross-site scripting caused by improper sanitization of user-supplied variables in the help_editor module, letting attackers execute scripts or download arbitrary markdown files, exploit requires user to follow a crafted link.

Severity & Score

Impact

Attackers can execute scripts in users' browsers or download arbitrary markdown files, potentially leading to data exposure or session compromise.

Mitigation

Update to version 27.0.3 or 28.0.1.

References

• https://github.com/aces/Loris/security/advisories/GHSA-j2p3-58m2-v6q3

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner