CVE-2026-34392

OVERVIEW CVE-2026-34392 is a path traversal vulnerability affecting LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application used for neuroimaging research data and project management. The vulnerability exists in versions 20.0.0 through 27.0.2 and 28.0.0, where a flaw in the static file router permits attackers to access files outside the intended directory through the static, css, and js endpoints. The vulnerability has been remediated in versions 27.0.3 and 28.0.1. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector requiring no privileges or user interaction, making it easily exploitable remotely. The attack has low complexity and results in high confidentiality impact, as attackers can download sensitive files from the affected system. There is no integrity or availability impact. The FAUCET Risk Score of 48.0/100 indicates a moderate-to-high risk profile, though the EPSS score of 0.00043 suggests current exploitation likelihood is relatively low. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The vulnerability remains inactive on exploit hotlists, and no public exploit code availability has been reported. Community attention appears limited, suggesting organizations using affected LORIS versions should prioritize patching to prevent potential future exploitation of this readily exploitable flaw.