An authenticated path traversal vulnerability in the LORIS research management system poses a severe risk of credential theft and subsequent unauthorized system access.

The application is susceptible to a path traversal flaw (CWE-22) that permits an authenticated user with sufficient authorization to bypass directory restrictions and access sensitive configuration files on the host server. This vulnerability allows the retrieval of hard-coded credentials, which may facilitate further unauthorized access to the database or connected services.

The compromise of configuration files containing hard-coded credentials constitutes a high-severity incident, reflected by its CVSS score of 8.1. Successful exploitation could lead to full database compromise or lateral movement within the environment, resulting in unauthorized data exfiltration, loss of research integrity, and significant reputational damage to the hosting institution.

Immediate Action: Administrators must upgrade LORIS to version 26.0.5, 27.0.2, or 28.0.0 or later to apply the security patch.

Proactive Monitoring: Review system and application access logs for unusual file read requests or attempts to traverse directory paths, particularly originating from authenticated user accounts.

Compensating Controls: If immediate patching is not feasible, administrators should disable the electrophysiology_browser module via the LORIS module manager to mitigate the primary attack vector.

Public Exploit Available: No

The severity of this vulnerability, combined with the potential for credential exposure, necessitates immediate attention from IT and security teams. Organizations should prioritize applying the provided security updates to their LORIS instances. If patching cannot be performed immediately, the recommended module deactivation should be implemented as a temporary measure to reduce the attack surface.