# CVE-2026-35169: aces LORIS XSS and arbitrary file download in help_editor

Source: https://junglewise.ai/threats/cve-2026-35169-aces-loris-xss-and-arbitrary-file-download-in-help-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-35169 · Severity: high · CVSS 8.7 · Published 2026-04-08

LORIS, a web-based platform for managing neuroimaging research data, contains a security flaw in its help editor module. An attacker could trick a researcher into clicking a malicious link to execute unauthorized scripts in their browser or download sensitive internal documentation files. This could lead to the theft of research data, unauthorized modification of project information, or exposure of internal system structures.

## Quick answers

**Is CVE-2026-35169 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35169 being exploited in the wild.

**How severe is CVE-2026-35169?** High severity, with a CVSS score of 8.7, published 8 April 2026.

**Which products and versions are affected?** aces LORIS >= 15.10, < 27.0.3; aces LORIS 28.0.0.

**Is there a fix for CVE-2026-35169?** A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35169 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-35169?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the help_editor module of LORIS due to insufficient sanitization of user-supplied variables. This flaw manifests as reflected Cross-Site Scripting (XSS) when a user is induced to follow a specially crafted link, and as an arbitrary file download vulnerability (CWE-552) allowing access to markdown files. The root cause is located in the ajax/help.php and Module.class.inc components, where input was used to fetch files without proper path validation or output encoding. Exploitation requires low-privileged user authentication and minimal user interaction. The issue is resolved in versions 27.0.3 and 28.0.1 by implementing strict path validation using realpath() and setting proper JSON content headers.

## Affected products

- aces LORIS >= 15.10, < 27.0.3
- aces LORIS 28.0.0

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched

## References

- [https://github.com/aces/Loris/security/advisories/GHSA-j2p3-58m2-v6q3](https://github.com/aces/Loris/security/advisories/GHSA-j2p3-58m2-v6q3)