XSS in Aces Loris
CVE-2026-35169
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (5.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Aces Loris — versions >= , < 27.0.3, >= 28.0.0, < 28.0.1
- Mcgill Loris — versions 28.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35169?
- CVE-2026-35169 is a high-severity vulnerability in Aces Loris, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-04-08.
- How severe is CVE-2026-35169?
- High severity. CVSS v3 base score is 8.7 out of 10.