CVE-2026-34985: File Access Vulnerability in LORIS

The core of this vulnerability lies in a discrepancy between the frontend and backend of LORIS's media module. While the frontend implements filtering to restrict user access to files, the backend lacks corresponding access checks. Consequently, an attacker who knows the filename of a restricted file can bypass these frontend protections and directly access the file. The potential impact includes unauthorized access to sensitive research data, potentially compromising the confidentiality of neuroimaging studies. While the vulnerability requires knowledge of the filename, the ease of obtaining this information depends on the specific LORIS deployment and file naming conventions.

1. Reserved2026-03-31
2. Published2026-04-08
3. Modified2026-04-10
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-34985 is to upgrade LORIS to version 27.0.3 or 28.0.1, which contain the necessary fixes. If an immediate upgrade is not feasible, consider implementing temporary workarounds. While a direct WAF rule is unlikely to be effective due to the filename dependency, restricting direct file access via the web server's configuration (e.g., .htaccess for Apache) could provide a limited layer of protection. Thoroughly review file naming conventions to minimize the risk of attackers guessing filenames. After upgrading, verify the fix by attempting to access a file known to be restricted to a user account that should not have access; access should be denied.