CVE-2026-26984: 
NixOS vulnerability analysis and mitigation

CVE-2026-26984 is a path traversal and unrestricted file upload vulnerability in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application for neuroimaging research data management. It affects LORIS versions prior to 26.0.5, 27.0.2, and 28.0.0, and was disclosed on February 25, 2026. An authenticated user with sufficient privileges can exploit the media module to upload a malicious file to an arbitrary server location, potentially achieving remote code execution (RCE). The vulnerability carries a CVSS v3.1 base score of 8.8 (High) per NVD, and 8.7 (High) per the GitHub Security Advisory (GitHub Advisory).

The vulnerability is rooted in two weaknesses: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-434 (Unrestricted Upload of File with Dangerous Type). The LORIS media module fails to properly sanitize or restrict file upload paths, allowing an attacker to supply path traversal sequences (e.g., ../) in the filename or upload destination parameter to write files outside the intended directory. Exploitation requires network access, low attack complexity, and an authenticated account with media module upload privileges. Once a malicious file (e.g., a PHP web shell) is placed in a web-accessible directory, it can be requested directly to achieve RCE (GitHub Advisory).

Successful exploitation allows an attacker to upload arbitrary files to any location writable by the web server process, and if the server is not configured as read-only, to achieve full remote code execution. This results in high impact to confidentiality, integrity, and availability of the affected system, potentially exposing sensitive neuroimaging research data and enabling complete server compromise. If the server is read-only, RCE is prevented but unauthorized file placement remains possible, which could still be leveraged for data tampering or denial of service (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0013 (0.13%), indicating a low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication and elevated privileges within the LORIS application, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify internet-facing LORIS instances running versions prior to 26.0.5 or 27.0.2 using web search, Shodan, or Censys, targeting the LORIS login page.
2. Authentication: Log in to the LORIS application using valid credentials for an account with media module upload permissions (e.g., a researcher or administrator account).
3. Access the media module: Navigate to the LORIS media module, which provides file upload functionality for neuroimaging data.
4. Craft malicious upload request: Intercept the file upload HTTP request (e.g., using Burp Suite) and modify the filename or destination path parameter to include path traversal sequences (e.g., ../../var/www/html/shell.php) to target a web-accessible directory.
5. Upload malicious file: Submit the crafted request with a dangerous file type (e.g., a PHP web shell) as the upload payload.
6. Trigger RCE: Access the uploaded file via the web server (e.g., https://target/shell.php?cmd=id) to execute arbitrary commands on the server (GitHub Advisory).

• Network: Unusual HTTP POST requests to LORIS media module upload endpoints containing path traversal sequences (../, %2e%2e%2f, or URL-encoded variants) in filename or path parameters; outbound connections from the web server to unknown external IPs following a file upload event.
• File System: Unexpected files (e.g., .php, .phtml, .jsp) appearing outside the designated LORIS media upload directory, particularly in web root or other web-accessible directories; newly created files with names containing traversal artifacts.
• Logs: Web server access logs showing POST requests to the LORIS media upload endpoint with anomalous filename parameters; subsequent GET requests to newly created files in unexpected directories; PHP error logs indicating execution of uploaded scripts.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python following a file upload event.

LORIS users should upgrade to version 26.0.5, 27.0.2, or 28.0.0 or later, as these releases contain the fix for this vulnerability (GitHub v26.0.5 Release, GitHub v27.0.2 Release). As an interim workaround, LORIS administrators can disable the media module if it is not actively required for operations (GitHub Advisory). Additionally, configuring the server as read-only will prevent RCE even if a malicious file is uploaded, though it does not prevent the file upload itself. Restricting media module access to only trusted, necessary accounts further reduces the attack surface.

The vulnerability was covered by The Hacker Wire, which highlighted the path traversal-to-RCE chain in the LORIS media module (The Hacker Wire). Social media activity was observed on Bluesky and Mastodon, primarily from automated CVE tracking accounts. The vulnerability was credited to Maxime Paillé and Guillaume Pillot of the Ministère de la Cybersécurité et du Numérique (Quebec), indicating responsible disclosure through a government cybersecurity body (GitHub Advisory).