CVE-2026-34392Disclosure(mcgill / loris)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.

mcgill CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/aces/Loris/security/advisories/GHSA-rfj5-58hv-wc5f

Weakness type (CWE)

CWE-552

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

loris

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-08); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

mcgill

Products

loris

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds183d
Disclosure
CVE-2026-34392 Path Traversal in LORIS Versions Before 27.0.3 and 28.0.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34392 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE-2026-34392, highlighting a path‑traversal flaw in older LORIS versions, and includes a link to a vulnerability details page but provides no exploit, patch, or active‑use information.
0000043
4.0K followersView on X
CVE@CVEnew183d
Disclosure
CVE-2026-34392 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20… https://www.cve.org/CVERecord?id=CVE-2026-34392
Post summary
The post references CVE-2026-34392 for a self-hosted neuroimaging web application but provides no PoC, exploit, patch, or detailed technical information.
00000103
57.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mcgill	loris	-	-	-
App	mcgill	loris	28.0.0	-	-

Explore more

Back to dashboard mcgill CVEs loris vulnerabilities