CVE-2026-33350 LORIS has a SQL injection in MRI feedback popup
Attackers can inject SQL via the MRI feedback popup to read or modify server data in the LORIS neuroimaging web application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33350?
CVE-2026-33350 is a high-severity SQL injection vulnerability in aces Loris, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1.
Weakness: CWE-89
Which versions are affected by CVE-2026-33350?
It affects 1 product.
Products include Mcgill Loris.
How do I fix CVE-2026-33350?
No fix has been published for CVE-2026-33350 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-33350 being exploited?
There is no known exploitation of CVE-2026-33350 in the wild and no public exploit code.
Other vulnerabilities in aces Loris
- CVE-2026-35169 LORIS has potential cross-site scripting in help_editor module
- CVE-2026-26984 LORIS media module vulnerable to remote code execution
- CVE-2026-26985 LORIS vulnerable to path traversal in electrophysiology_browser
- CVE-2026-35446 LORIS has a path traversal in FilesDownloadHandler
- CVE-2026-34392 LORIS has a path traversal in static router
Sources
Also known as GHSA-9r29-6jgc-3ggh.