CVE-2026-35403

MEDIUM

6.5

Description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label. While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link. This vulnerability is fixed in 27.0.3 and 28.0.1.

CVE Details

CVSS v3.1 Score6.5

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredLOW

User InteractionREQUIRED

Published4/8/2026

Last Modified4/8/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-79

References

https://github.com/aces/Loris/security/advisories/GHSA-776p-5pwh-vc8p(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.