CVE-2026-34985

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34985
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34985.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34985
Aliases
  • GHSA-p42c-4gmq-hrjw
Published
2026-04-08T18:22:09.927Z
Modified
2026-07-08T08:12:57.655921782Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
LORIS has incorrect access checks in media module
Details

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would be possible for someone who should not have access to a file to access it if they know the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34985.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/aces/loris

Affected ranges

Type
GIT
Repo
https://github.com/aces/loris
Events
Introduced
5ca12c1ca227cd0766e5d88f504dd3996fcc644c
Fixed
f57f54b42a076bf53ba86e20d4dbf37f63538f58
Introduced
83141ca814d2b8bda0e483589b726ea27f6ed4f7
Fixed
c9bb7c87b405b4e0892cda25ab5fc791bcd562f4
Database specific 
{
    "extracted_events": [
        {
            "introduced": "16.1.0"
        },
        {
            "fixed": "27.0.3"
        },
        {
            "introduced": "28.0.0"
        },
        {
            "fixed": "28.0.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

28.*
28.0.0
v28.*
v28.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34985.json"