CVE-2026-33350

LORIS (Longitudinal Online Research and Imaging System) versions prior to 27.0.3 and 28.0.1 contain a SQL injection vulnerability in the MRI feedback popup window of the imaging browser module. This self-hosted neuroimaging research data management application is susceptible to unauthorized data access and modification through malicious SQL queries. The vulnerability affects the application's ability to securely handle user input in specific code sections related to imaging feedback functionality. The vulnerability carries a CVSS 3.1 severity rating of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, indicating that exploitation does not require specialized conditions or insider knowledge. The primary impact is confidentiality compromise, allowing attackers to access sensitive neuroimaging research data stored on affected servers, though data integrity and system availability are not directly impacted by this particular vulnerability. Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on relevant threat tracking lists. The EPSS score of 0.00044 indicates this vulnerability is currently exploited less frequently than the majority of public CVEs. Organizations running affected LORIS versions should apply patches 27.0.3 or 28.0.1 to remediate this risk, particularly given the sensitive nature of neuroimaging research data.