An authenticated path traversal vulnerability in the LORIS neuroimaging research platform allows remote code execution, posing a severe risk to data integrity and system control.

This vulnerability involves a path traversal flaw combined with unrestricted file upload capabilities. An authenticated user with sufficient privileges can upload malicious files to arbitrary server locations, leading to remote code execution.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the LORIS server, potentially leading to a full system compromise. Given the platform's role in managing sensitive neuroimaging research data, this poses a significant risk to data confidentiality and research integrity. With a CVSS score of 8.7, this is classified as a High severity issue that requires immediate attention to prevent unauthorized administrative access.

Immediate Action: Update the LORIS installation to version 26.0.5, 27.0.2, or 28.0.0 or later to apply the vendor-provided patch.

Proactive Monitoring: Review web server and application access logs for unusual file upload activity or requests containing directory traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: If an immediate update is not feasible, administrators should disable the media module within the LORIS application to mitigate the attack vector.

Public Exploit Available: Unknown.

The risk associated with this vulnerability is elevated due to the potential for remote code execution. Organizations utilizing LORIS must prioritize patching their environments to the specified secure versions. If patching is delayed, disabling the vulnerable media module is a necessary step to maintain system security against potential abuse by authenticated actors.