An unauthenticated directory traversal vulnerability in LORIS allows remote attackers to access sensitive files, posing a significant risk to data confidentiality.

The application contains a flaw in its static file router that fails to properly sanitize user input, enabling path traversal attacks. This vulnerability allows an unauthenticated attacker to bypass directory restrictions and retrieve sensitive files from the server.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive research data, configuration files, or system credentials. Given the CVSS score of 7.5, this high-severity flaw carries a substantial risk of data compromise and potential regulatory non-compliance regarding research data privacy.

Immediate Action: Upgrade your LORIS installation to version 27.0.3 or 28.0.1 immediately to incorporate the provided security fix.

Proactive Monitoring: Review web access logs for suspicious requests containing directory traversal patterns, such as sequences of dots and slashes, directed at the static, css, or js endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and normalize URI paths to prevent malicious traversal payloads from reaching the application.

Public Exploit Available: Unknown.

This vulnerability presents a clear and present danger to the integrity of sensitive neuroimaging research data. Administrators should prioritize the update to the patched versions of LORIS to remediate this directory traversal flaw. If immediate patching is not possible, implement strict network ingress filtering and WAF rules to minimize the attack surface until the software can be updated.