CVE-2026-39985

Published: Apr 9, 2026Modified: Apr 22, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.

Affected (2)

Products: Mcgill: Loris

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mcgill Loris	Before 27.0.3
Mcgill Loris	Version 28.0.0

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (4)

https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58

Source: security-advisories@github.com

Patch

https://github.com/aces/Loris/releases/tag/v27.0.3

Source: security-advisories@github.com

Release Notes

https://github.com/aces/Loris/releases/tag/v28.0.1

Source: security-advisories@github.com

Release Notes

https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.