LORIS hat potenziell Cross-Site Scripting im help_editor Modul

Successful exploitation of CVE-2026-35169 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the LORIS system. This could lead to session hijacking, data theft (including sensitive research data), or defacement of the LORIS interface. The ability to download arbitrary markdown files expands the attack surface, potentially enabling attackers to exfiltrate configuration files or other sensitive data stored on the server. The impact is particularly concerning given LORIS's use in neuroimaging research, where data privacy and integrity are paramount.

Research institutions and laboratories utilizing LORIS to manage neuroimaging data are at significant risk. Organizations with legacy LORIS deployments or those that have not implemented robust input validation practices are particularly vulnerable. Shared hosting environments where multiple LORIS instances reside on the same server could also be affected, as a successful attack on one instance could potentially compromise others.

• php: Examine LORIS application logs for suspicious requests containing <script> tags or other XSS payloads within the help_editor module.

grep -i '<script' /var/log/loris/application.log

• generic web: Use curl to test for XSS by injecting a simple payload into a parameter handled by the help_editor module and observing the response for script execution.

curl 'http://loris-server/help_editor?input=<script>alert(1)</script>' 

• generic web: Check access logs for unusual user agent strings or referral URLs associated with requests to the help_editor module.

1. 2026-04-08Disclosure

   disclosure

2. 2026-04-08Patch

   patch

1. Reserviert2026-04-01
2. Veröffentlicht2026-04-08
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2026-35169 is to immediately upgrade LORIS to version 27.0.3 or 28.0.1. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on the helpeditor module to sanitize user-supplied variables. Web Application Firewalls (WAFs) configured to detect and block reflected XSS attacks can provide an additional layer of defense. Review LORIS access controls to limit who can access the helpeditor functionality. After upgrading, confirm the vulnerability is resolved by attempting to trigger the XSS payload via a crafted URL; the payload should be neutralized.