# CVE-2026-33350: aces LORIS SQL injection in MRI feedback popup

Source: https://junglewise.ai/threats/cve-2026-33350-aces-loris-sql-injection-in-mri-feedback-popup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33350 · Severity: high · CVSS 7.5 · Published 2026-04-08

LORIS, a web-based platform used by research institutions to manage neuroimaging data and projects, contains a security flaw in its imaging browser component. An attacker could exploit this to view or modify sensitive research data stored in the system's database. This could lead to the unauthorized exposure of medical research information or the corruption of project records.

## Quick answers

**Is CVE-2026-33350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33350 being exploited in the wild.

**How severe is CVE-2026-33350?** High severity, with a CVSS score of 7.5, published 8 April 2026.

**Which products and versions are affected?** aces Loris < 27.0.3, >= 28.0.0, < 28.0.1.

**Is there a fix for CVE-2026-33350?** A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33350 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33350?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the MRI feedback popup window of the LORIS imaging browser. The flaw is caused by improper neutralization of user-supplied input before it is used in SQL queries (CWE-89). A remote, unauthenticated attacker can exploit this over the network with low complexity to execute arbitrary SQL commands. This allows for the unauthorized retrieval of sensitive database information or the modification of existing records. The issue is resolved in versions 27.0.3 and 28.0.1.

## Affected products

- aces Loris < 27.0.3, >= 28.0.0, < 28.0.1

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched

## References

- [https://github.com/aces/Loris/security/advisories/GHSA-9r29-6jgc-3ggh](https://github.com/aces/Loris/security/advisories/GHSA-9r29-6jgc-3ggh)