CVE-2026-39985 LORIS has an open redirect field on login
Attackers can trick users into visiting malicious sites via unvalidated login redirect parameters in the LORIS neuroimaging platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-39985?
CVE-2026-39985 is a medium-severity vulnerability in aces Loris, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.
Weakness: CWE-601
Which versions are affected by CVE-2026-39985?
It affects 1 product.
Products include Mcgill Loris.
How do I fix CVE-2026-39985?
No fix has been published for CVE-2026-39985 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39985 being exploited?
There is no known exploitation of CVE-2026-39985 in the wild and no public exploit code.
Other vulnerabilities in aces Loris
- CVE-2026-35169 LORIS has potential cross-site scripting in help_editor module
- CVE-2026-26984 LORIS media module vulnerable to remote code execution
- CVE-2026-26985 LORIS vulnerable to path traversal in electrophysiology_browser
- CVE-2026-35446 LORIS has a path traversal in FilesDownloadHandler
- CVE-2026-33350 LORIS has a SQL injection in MRI feedback popup
Sources
Also known as GHSA-rch2-f5fw-cg95.