CVE-2026-35400 LORIS incorrectly trusts user input in publication module

Low 3.5 Published 8 Apr 2026 Updated 8 Apr 2026

Attackers with publication access can forge emails appearing to come from LORIS by manipulating the baseURL, potentially enabling phishing or trust abuse.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-35400?

CVE-2026-35400 is a low-severity vulnerability in aces Loris, published on 8 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value. This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS. This vulnerability is fixed in 27.0.3 and 28.0.1.

Weakness: CWE-59

Which versions are affected by CVE-2026-35400?

It affects 1 product.

Products include Mcgill Loris.

How do I fix CVE-2026-35400?

No fix has been published for CVE-2026-35400 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-35400 being exploited?

There is no known exploitation of CVE-2026-35400 in the wild and no public exploit code.

Sources

Also known as GHSA-6prw-34x8-3gpg.