A vulnerability in the LORIS neuroimaging research platform allows authenticated attackers to perform cross-site scripting and unauthorized file retrieval, posing a significant risk to data integrity.

This vulnerability consists of an improper input sanitization flaw in the help_editor module, requiring a low-privileged authenticated user to trigger the malicious payload. The flaw allows for both reflected cross-site scripting and the unauthorized download of arbitrary markdown files from the server.

The ability to execute arbitrary scripts in the context of a user session can lead to session hijacking and unauthorized administrative actions, while the arbitrary file read capability may expose sensitive research data. Given the CVSS score of 8.7, this is classified as a high-severity issue that could undermine the confidentiality and integrity of research environments managed by the LORIS application.

Immediate Action: Update the LORIS installation to version 27.0.3 or 28.0.1 immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at the help_editor module or patterns indicative of file traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block suspicious input patterns associated with cross-site scripting and directory traversal to provide a temporary layer of protection.

Public Exploit Available: No — no confirmed public exploit exists.

Organizations utilizing the LORIS platform must prioritize the transition to the corrected versions, 27.0.3 or 28.0.1. Given the potential for unauthorized data access and session compromise, delaying these updates increases the risk of exploitation by malicious actors targeting research assets.