CVE-2026-35446: Mcgill Loris

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.

Affected products

• Mcgill Loris: from 24.0.0, up to and including 27.0.2; version 28.0.0 only

Published 2026-04-08. Last modified 2026-07-24.