CVE-2026-39985

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39985
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39985.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39985
Aliases
  • GHSA-rch2-f5fw-cg95
Published
2026-04-09T17:08:49.668Z
Modified
2026-07-15T01:49:06.545430Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
LORIS has an open redirect field on login
Details

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.

Database specific 
{
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39985.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/aces/loris

Affected ranges

Type
GIT
Repo
https://github.com/aces/loris
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f57f54b42a076bf53ba86e20d4dbf37f63538f58
Introduced
83141ca814d2b8bda0e483589b726ea27f6ed4f7
Fixed
c9bb7c87b405b4e0892cda25ab5fc791bcd562f4
Database specific 
{
    "cpe": [
        "cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mcgill:loris:28.0.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "27.0.3"
        },
        {
            "introduced": "28.0.0"
        },
        {
            "last_affected": "28.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

28.*
28.0.0
Other
GitHubRelease-201312111
PublicRelease2
loris-14.*
loris-14.10
loris-14.12
v15.*
v15.10-rc1
v15.10-rc2
v15.10-rc3
v15.10-rc4
v15.10-rc5
v15.4
v15.4k
v17.*
v17.0.0
v17.0.0-rc1
v23.*
v23.0.7
v27.*
v27.0.0
v27.0.1
v27.0.2
v28.*
v28.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39985.json"