An authenticated directory traversal vulnerability in the ACES LORIS platform allows unauthorized file access, posing a high risk to sensitive research data.

This vulnerability is caused by an incorrect order of operations in the FilesDownloadHandler, which permits authenticated users to escape designated download directories and access arbitrary files on the server.

The ability for an authenticated user to traverse the file system could lead to the unauthorized disclosure of sensitive neuroimaging research data, configuration files, or system credentials. With a CVSS score of 7.7, this high-severity vulnerability represents a significant risk to data confidentiality and regulatory compliance within research environments.

Immediate Action: Update the LORIS application to version 27.0.3 or 28.0.1 immediately to incorporate the provided fix.

Proactive Monitoring: Monitor server access logs for requests containing suspicious directory traversal patterns, such as sequences of dot-dot-slash (../).

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the service account's file system permissions to only those directories strictly required for operation.

Public Exploit Available: No (exploit_available unknown)

Given the potential for unauthorized data access and the high CVSS severity rating, organizations utilizing the LORIS platform must prioritize applying the identified patches. Ensure that internal access controls remain robust to prevent unauthorized users from leveraging this vulnerability to compromise the integrity of the research environment.