CVE-2026-35169: LORIS Help Editor XSS Vulnerability

CVE-2026-35169 Overview

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data and project management for neuroimaging research. A vulnerability has been identified in the help_editor module of LORIS where user-supplied variables are not properly sanitized. This improper input validation could result in a reflected cross-site scripting (XSS) attack if a user is tricked into following a malicious link. Additionally, the same input vector could allow an attacker to download arbitrary markdown files on an unpatched server.

Critical Impact

Attackers can execute malicious scripts in victim browsers and potentially exfiltrate sensitive neuroimaging research data through reflected XSS, or access arbitrary markdown files on vulnerable LORIS servers.

Affected Products

• LORIS versions prior to 27.0.3
• LORIS versions prior to 28.0.1

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-35169 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35169

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the help_editor module of LORIS, which fails to properly sanitize user-supplied input before incorporating it into web page output or file system operations.

The vulnerability requires user interaction—specifically, a victim must be tricked into clicking a malicious link crafted by an attacker. When exploited, the attack can cross security boundaries affecting both confidentiality and integrity of the target system while operating across different user sessions.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the help_editor module. The module accepts user-controlled variables that are subsequently used in contexts where they should be sanitized—both in HTML output (leading to XSS) and in file path operations (leading to arbitrary file download). This dual-use of unsanitized input creates multiple attack surfaces from a single vulnerability point.

Attack Vector

The attack is network-based and requires an attacker to craft a malicious URL containing the XSS payload or file path traversal sequence. The attacker must then social engineer a victim with a valid LORIS session to click the link. Upon clicking, the malicious script executes in the victim's browser context with their session privileges, or alternatively, triggers the download of arbitrary markdown files from the server.

The vulnerability mechanism involves insufficient sanitization in the help_editor module's handling of user input. An attacker can inject malicious script tags or path traversal sequences through URL parameters that are reflected back without proper encoding. For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35169

Indicators of Compromise

• Unusual URL patterns in web server logs containing help_editor module references with encoded script tags or path traversal sequences
• HTTP requests to the help_editor endpoint containing <script>, javascript:, or ../ patterns
• Unexpected access patterns to markdown files outside normal application directories

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads targeting the help_editor module
• Monitor web server access logs for requests containing encoded special characters like %3Cscript%3E or path traversal sequences
• Deploy Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Use SIEM correlation rules to identify repeated malicious requests from single sources

Monitoring Recommendations

• Enable detailed logging for all requests to the LORIS help_editor module
• Configure alerts for unusual file access patterns, particularly markdown files accessed through the help_editor pathway
• Monitor for session anomalies that may indicate successful XSS-based session hijacking
• Review referrer headers for suspicious external sources directing traffic to help_editor endpoints

How to Mitigate CVE-2026-35169

Immediate Actions Required

• Upgrade LORIS to version 27.0.3 or 28.0.1 immediately
• If immediate patching is not possible, consider temporarily disabling the help_editor module
• Review access logs for potential prior exploitation attempts
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

The LORIS development team has addressed this vulnerability in versions 27.0.3 and 28.0.1. Organizations should upgrade to these patched versions as soon as possible. Detailed patch information and release notes are available through the GitHub Security Advisory.

Workarounds

• Implement strict WAF rules to filter XSS payloads and path traversal attempts in requests to the help_editor module
• Restrict access to the help_editor module to only trusted administrative users
• Deploy network-level controls to limit access to LORIS instances from untrusted networks
• Enable HTTP-only and Secure flags on session cookies to reduce XSS impact

# Example Apache configuration to restrict help_editor access
<LocationMatch "/loris/help_editor">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</LocationMatch>