CVE-2026-34985

OVERVIEW CVE-2026-34985 affects LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application used for data and project management in neuroimaging research. The vulnerability exists in versions 16.1.0 through 27.0.2 and 28.0.0, where the media module's backend fails to properly validate file access permissions. An authenticated user could bypass access controls and retrieve files they should not have access to if they know the filename, despite the frontend implementing appropriate filtering mechanisms. SEVERITY This vulnerability carries a CVSS score of 6.5 (Medium) and requires network access with low attack complexity. The attacker must be an authenticated user with valid credentials, but no user interaction is necessary for exploitation. The primary impact is confidentiality compromise, as sensitive neuroimaging research data could be accessed by unauthorized personnel. No integrity or availability impact is present. The FAUCET risk score of 44.0 indicates moderate concern from a risk prioritization perspective. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability not appearing on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00032 suggests minimal probability of exploitation in the wild relative to other vulnerabilities. No public exploit code is currently documented, and community attention remains limited. Organizations running affected versions should prioritize patching to versions 27.0.3 or 28.0.1, though the low exploitation likelihood allows for standard patch management timelines.