CVE-2026-26984

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with sufficient privileges can exploit a path traversal vulnerability to upload a malicious file to an arbitrary location on the server. Once uploaded, the file can be used to achieve remote code execution (RCE). An attacker must be authenticated and have the appropriate permissions to exploit this issue. If the server is configured as read-only, remote code execution (RCE) is not possible; however, the malicious file upload may still be achievable. This problem is fixed in LORIS v26.0.5 and above, v27.0.2 and above, and v28.0.0 and above. As a workaround, LORIS administrators can disable the media module if it is not being used.

• CWE-22
• CWE-434
• CWE-22

• https://github.com/aces/Loris/releases/tag/v26.0.5Product, Release Notes
• https://github.com/aces/Loris/releases/tag/v27.0.2Product, Release Notes
• https://github.com/aces/Loris/security/advisories/GHSA-mpgc-c48m-6v2hVendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26979Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-2698An improper access control vulnerability exists where an aut…6.5
• CVE-2026-26980Ghost is a Node.js content management system. Versions 3.24.…7.5
• CVE-2026-26981OpenEXR provides the specification and reference implementat…6.5
• CVE-2026-26982Ghostty is a cross-platform terminal emulator. Ghostty allow…8.8
• CVE-2026-26983ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-26985LORIS (Longitudinal Online Research and Imaging System) is a…6.5
• CVE-2026-26986FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2026-26987LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…6.1
• CVE-2026-26988LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…9.1
• CVE-2026-26989LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…4.8
• CVE-2026-2699Customer Managed ShareFile Storage Zones Controller (SZC) al…9.8