VulnSocial

CVE-2026-35446Disclosure(mcgill / loris)

LOWCVSS 8.6 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.

mcgill CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-552

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • loris

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
mcgill
Products
loris

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-08: 2Technical Details · 2026-04-08: 104-08
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-35446 Path Traversal in LORIS Versions 24.0.0 Through 27.0.2 and 28.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35446 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The post announces CVE-2026-35446, a path traversal vulnerability affecting certain LORIS versions, without detailing PoC, exploit code, active exploitation, patches, or debunking information.

    0000036
    4.0K followersView on X
  • CVE@CVEnew
    General

    CVE-2026-35446 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24… https://www.cve.org/CVERecord?id=CVE-2026-35446

    Post summary

    The excerpt merely references a CVE entry for LORIS and links to the CVE record, without providing any technical details, patch information, or exploitation evidence.

    00000134
    57.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appmcgillloris---
Appmcgillloris28.0.0--

Explore more

Back to dashboardmcgill CVEsloris vulnerabilities