VulnSocial

CVE-2026-35169General(mcgill / loris)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch mcgill loris systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.

mcgill CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79CWE-552

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • loris

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-04-09)
  • 3 total mentions across 2 days

Affected systems

Vendors
mcgill
Products
loris

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-08: 1Mentions · 2026-04-09: 2Patch / Workaround · 2026-04-09: 1Technical Details · 2026-04-09: 204-0804-09
Signal classification3 categories
General
133.3%
Disclosure
133.3%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-081
General1
2026-04-092
Disclosure1Patch1
Full discourse3 posts
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-35169: HIGH] Ensure cyber security by patching LORIS to versions 27.0.3 and 28.0.1. Vulnerability in the help_editor module leaves servers open to cross-site scripting attacks.#cve,CVE-2026-35169,#cybersecurity https://cvefind.com/CVE-2026-35169

    Post summary

    The post informs users of CVE‑2026‑35169, an XSS flaw in LORIS’s help_editor module, and urges updating to patched versions 27.0.3 and 28.0.1.

    0000046
    619 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-35169 Reflected Cross-Site Scripting and Arbitrary File Download in LORIS Before 27.0.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35169

    Post summary

    A new CVE, CVE-2026-35169, has been disclosed, describing reflected XSS and arbitrary file download issues in LORIS versions earlier than 27.0.3, with details available via the provided Vulmon link.

    0000035
    4.0K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-35169 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From t… https://www.cve.org/CVERecord?id=CVE-2026-35169

    Post summary

    The statement merely references CVE-2026‑35169 for LORIS without furnishing any vulnerability, exploit, or mitigation details.

    00000237
    57.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appmcgillloris---
Appmcgillloris28.0.0--

Explore more

Back to dashboardmcgill CVEsloris vulnerabilities