Medium 6.1Published Apr 9, 2026

CVE-2026-39985LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research.

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects mcgill loris. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for mcgill loris

Exploited in the last 30 days

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.

CVSS: 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-601
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

mcgill loris mcgill:loris	before 27.0.3; 28.0.0	NVD

References

https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58patch
https://github.com/aces/Loris/releases/tag/v27.0.3release-notes
https://github.com/aces/Loris/releases/tag/v28.0.1release-notes
https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.