CVE-2026-26985: 
NixOS vulnerability analysis and mitigation

CVE-2026-26985 is a path traversal vulnerability in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application used for neuroimaging research data management. The flaw exists in the electrophysiology_browser module and allows authenticated users with appropriate authorization to read arbitrary configuration files on the server, some of which contain hard-coded credentials. It affects LORIS versions starting from 24.0.0 up to (but not including) 26.0.5, and versions 27.0.0 up to (but not including) 27.0.2. The vulnerability was disclosed on February 25, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.1 (High) per the GitHub Security Advisory, reflecting high confidentiality and integrity impacts (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The electrophysiology_browser module fails to properly sanitize or restrict file path inputs, allowing an attacker to craft requests that traverse outside the intended directory and access arbitrary files on the server filesystem. Because LORIS configuration files may contain hard-coded database credentials and service secrets, a successful traversal can expose these sensitive values. The application source code is publicly available on GitHub, which lowers the barrier for exploitation since attackers can study the codebase to identify vulnerable endpoints and craft precise payloads (GitHub Advisory).

Successful exploitation allows an authenticated attacker to read server-side configuration files containing hard-coded credentials for databases and other backend services. An attacker who obtains these credentials could authenticate directly to the database or other services, potentially leading to unauthorized access, modification, or exfiltration of sensitive neuroimaging research data. The CVSS score reflects high confidentiality and integrity impacts, with no availability impact; however, credential reuse could enable lateral movement to backend systems beyond the LORIS application itself (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.038%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the lack of active exploitation, the vulnerability is described as easy to exploit for users who meet the authentication and authorization prerequisites, and the public availability of LORIS source code increases the risk of future weaponization (GitHub Advisory).

1. Reconnaissance: Identify a LORIS instance running a vulnerable version (24.0.0–26.0.4 or 27.0.0–27.0.1) by reviewing publicly accessible login pages or version disclosures. Review the public LORIS source code on GitHub to identify the electrophysiology_browser module's file-serving endpoints.
2. Authentication: Log in to the LORIS application using valid credentials for an account that has authorization to access the electrophysiology_browser module.
3. Craft path traversal payload: Identify the endpoint within electrophysiology_browser that accepts a file path parameter. Construct a request with a path traversal sequence (e.g., ../../) to navigate outside the intended directory toward sensitive configuration files (e.g., LORIS config.xml or database configuration files).
4. Send malicious request: Submit the crafted HTTP request to the vulnerable endpoint, causing the server to read and return the contents of the targeted configuration file.
5. Extract credentials: Parse the returned file content to extract hard-coded database credentials or other service secrets.
6. Lateral movement: Use the extracted credentials to authenticate directly to the backend database or other services, enabling unauthorized data access or modification of neuroimaging research data (GitHub Advisory).

• Network: Unusual HTTP requests to electrophysiology_browser module endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f, or URL-encoded variants) in file path parameters; outbound connections from the LORIS server to unexpected external hosts following such requests.
• Logs: Web server access logs showing requests to electrophysiology_browser endpoints with traversal patterns in query parameters or request bodies; repeated access attempts to configuration file paths (e.g., config.xml, .env, database config files) from authenticated sessions.
• File System: Unexpected access timestamps on LORIS configuration files (e.g., config.xml) that do not correspond to normal application activity.
• Authentication: Unexpected or anomalous logins to the backend database or associated services from IP addresses not associated with normal application server traffic, potentially indicating credential reuse after extraction (GitHub Advisory).

The vulnerability is fixed in LORIS v26.0.5 (for the 26.x branch), v27.0.2 (for the 27.x branch), and v28.0.0 and above. Administrators should upgrade to one of these patched versions as the primary remediation (GitHub v26.0.5 Release, GitHub v27.0.2 Release). As a temporary workaround for instances that cannot be immediately patched, administrators can disable the electrophysiology_browser module using the LORIS module manager. Additionally, administrators should review and rotate all hard-coded credentials found in LORIS configuration files, implement strict access controls limiting which users can access the electrophysiology_browser module, and monitor configuration file access for suspicious activity (GitHub Advisory).

The vulnerability was credited to Maxime Paillé and Guillaume Pillot of the Ministère de la Cybersécurité et du Numérique (Quebec's Ministry of Cybersecurity and Digital Affairs), indicating responsible disclosure through a government cybersecurity body (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.