LORIS incorrectly trusts user input in publication module

The primary impact of CVE-2026-35400 is the potential for email spoofing. An attacker who has access to the publication module within LORIS can manipulate the baseURL parameter in a POST request to specify an arbitrary external domain. This allows them to craft emails that appear to be sent by LORIS, but are actually originating from the attacker's controlled domain. While the vulnerability is rated LOW severity, successful exploitation could damage the reputation of the research institution using LORIS, lead to phishing attacks targeting researchers, or be used to distribute malicious content under the guise of official LORIS communications. The attacker needs existing publication module access to exploit this, limiting the immediate blast radius.

Research institutions and laboratories utilizing LORIS for neuroimaging data management are at risk. Specifically, organizations with multiple users having access to the publication module, or those running older, unpatched versions of LORIS, are particularly vulnerable. Shared hosting environments where multiple LORIS instances are deployed on the same server could also increase the risk of lateral movement if one instance is compromised.

• php: Examine LORIS application logs for suspicious POST requests to the publication module containing unusual or external baseURL values. Use grep to search for patterns like POST /publication_module.php ... baseURL=attacker.com ... • generic web: Monitor email logs for emails originating from the LORIS server but with sender addresses or domains that are not associated with the legitimate LORIS infrastructure.

1. 2026-04-08Disclosure

   disclosure

1. Gereserveerd2026-04-02
2. Gepubliceerd2026-04-08
3. EPSS bijgewerkt2026-04-16

The primary mitigation for CVE-2026-35400 is to upgrade LORIS to version 27.0.3 or 28.0.1. These versions contain a fix that properly validates the baseURL parameter, preventing the email spoofing vulnerability. If upgrading is not immediately feasible, consider implementing stricter access controls for the publication module to limit the number of users who can potentially exploit the vulnerability. While a direct WAF rule is difficult to implement due to the POST parameter manipulation, monitoring for unusual email sending patterns originating from the LORIS server could provide an early warning sign of potential exploitation. After upgrading, confirm the fix by attempting to submit a publication request with a malicious baseURL and verifying that the request is rejected.