Executive brief
LORIS, a web-based platform for managing neuroimaging research data, contains a security flaw in its help editor module. An attacker could trick a researcher into clicking a malicious link to execute unauthorized scripts in their browser or download sensitive internal documentation files. This could lead to the theft of research data, unauthorized modification of project information, or exposure of internal system structures.
Technical details
A vulnerability exists in the help_editor module of LORIS due to insufficient sanitization of user-supplied variables. This flaw manifests as reflected Cross-Site Scripting (XSS) when a user is induced to follow a specially crafted link, and as an arbitrary file download vulnerability (CWE-552) allowing access to markdown files. The root cause is located in the ajax/help.php and Module.class.inc components, where input was used to fetch files without proper path validation or output encoding. Exploitation requires low-privileged user authentication and minimal user interaction. The issue is resolved in versions 27.0.3 and 28.0.1 by implementing strict path validation using realpath() and setting proper JSON content headers.
Affected products
- aces LORIS >= 15.10, < 27.0.3
- aces LORIS 28.0.0
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched