CVE-2026-34392: 
NixOS vulnerability analysis and mitigation

CVE-2026-34392 is a path traversal vulnerability in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application used for neuroimaging research data and project management. A bug in the static file router allows unauthenticated attackers to traverse outside the intended directory and download arbitrary files via the static, css, and js endpoints. The vulnerability affects LORIS versions 20.0.0 through 27.0.2 and version 28.0.0, and is fixed in 27.0.3 and 28.0.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-552 (Files or Directories Accessible to External Parties). The vulnerability exists in src/Router/ModuleFileRouter.php, where the handle() method constructs a file path by directly concatenating the module directory, subdirectory, and the user-supplied URL path without validating that the resolved path remains within the intended base directory. An attacker can supply path traversal sequences (e.g., ../../) in requests to the /static, /css, or /js endpoints to escape the configured subdirectory and access arbitrary files on the server filesystem. The fix applies realpath() to both the requested path and the base directory, then verifies the resolved path starts with the base directory before serving the file (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files accessible to the LORIS web application process, resulting in a high confidentiality impact. Given that LORIS handles sensitive neuroimaging research data and project management information, exposed files could include configuration files with database credentials, research participant data, or other sensitive application files. There is no integrity or availability impact, but credential exposure via configuration files could enable further lateral movement or full application compromise (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported at this time. The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any network-accessible attacker against a vulnerable LORIS instance. The EPSS score is approximately 0.031% (0.000310), indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify internet-facing LORIS instances (versions 20.0.0–27.0.2 or 28.0.0) using search engines or network scanning tools targeting known LORIS web application signatures.
2. Identify vulnerable endpoints: Confirm the target exposes the /static, /css, or /js endpoints, which are served by the vulnerable ModuleFileRouter.
3. Craft traversal payload: Construct an HTTP GET request with path traversal sequences in the URL path, e.g., GET /static/../../../../../../etc/passwd or targeting application configuration files such as config.xml or .env.
4. Send request: Submit the crafted request to the target server without any authentication headers.
5. Retrieve sensitive files: If successful, the server returns the contents of the traversed file. Repeat with targeted paths (e.g., database configuration files) to extract credentials or sensitive research data for further exploitation (GitHub Advisory).

• Network: Unusual HTTP GET requests to /static/, /css/, or /js/ endpoints containing ../ or URL-encoded traversal sequences (e.g., %2e%2e%2f) in the path; requests to these endpoints returning unexpected content types (e.g., text/plain for configuration files).
• Logs: Web server access logs showing requests to static endpoints with traversal patterns and HTTP 200 responses for non-static file paths; repeated requests probing different relative paths from a single source IP.
• File System: No direct file system artifacts expected from read-only exploitation, but evidence of accessed sensitive files (e.g., config.xml, .env, database credential files) may be inferred from log analysis.

Upgrade LORIS to version 27.0.3 or 28.0.1, which contain the fix that validates the resolved file path against the base directory using realpath() before serving files. No official workaround is provided by the vendor for unpatched versions. As an interim measure, administrators can restrict network access to LORIS instances to trusted IP ranges and monitor web server logs for path traversal patterns in requests to static endpoints (GitHub Advisory).

The vulnerability was reported by security researcher alexaubut and disclosed via GitHub Security Advisories on April 8, 2026. A brief mention appeared on Bluesky via the CyberHub blog. No significant broader media coverage or notable researcher commentary beyond the initial advisory has been identified (GitHub Advisory).