Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.
Affected products
mcgill: loris
References4
- github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95 Vendor Advisory
- github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63… Patch
- github.com/aces/Loris/releases/tag/v27.0.3 Release Notes
- github.com/aces/Loris/releases/tag/v28.0.1 Release Notes
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 11 · as of 12 November 2026
- CWE
- CWE-601
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.