CVE-2026-26985
中文标题:
（暂无数据）
英文标题:
LORIS vulnerable to path traversal in electrophysiology_browser
漏洞描述
中文描述:
（暂无数据）
英文描述:
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenticated user with the appropriate authorization can read configuration files on the server by exploiting a path traversal vulnerability. Some of these files contain hard-coded credentials. The vulnerability allows an attacker to read configuration files containing hard-coded credentials. The attacker could then authenticate to the database or other services if those credentials are reused. The attacker must be authenticated and have the required permissions. However, the vulnerability is easy to exploit and the application source code is public. This problem is fixed in LORIS v26.0.5 and v27.0.2 and above, and v28.0.0 and above. As a workaround, the electrophysiogy_browser in LORIS can be disabled by an administrator using the module manager.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| aces | Loris | >= 24.0.0, < 26.0.5 | - | - |
cpe:2.3:a:aces:loris:>=_24.0.0,_<_26.0.5:*:*:*:*:*:*:*
|
| aces | Loris | >= 27.0.0, < 27.0.2 | - | - |
cpe:2.3:a:aces:loris:>=_27.0.0,_<_27.0.2:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2026-26985 |
2026-02-26 03:19:56 | 2026-02-25 22:00:01 |
| NVD | nvd_CVE-2026-26985 |
2026-02-26 02:00:04 | 2026-02-25 22:00:04 |
版本与语言
安全公告
变更历史
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']