LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1.
References
| Link | Resource |
|---|---|
| https://github.com/aces/Loris/security/advisories/GHSA-9r29-6jgc-3ggh | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Apr 2026, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mcgill:loris:*:*:*:*:*:*:*:* cpe:2.3:a:mcgill:loris:28.0.0:*:*:*:*:*:*:* |
|
| References | () https://github.com/aces/Loris/security/advisories/GHSA-9r29-6jgc-3ggh - Vendor Advisory | |
| First Time |
Mcgill
Mcgill loris |
08 Apr 2026, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-08 19:25
Updated : 2026-04-17 15:50
NVD link : CVE-2026-33350
Mitre link : CVE-2026-33350
CVE.ORG link : CVE-2026-33350
JSON object : View
Products Affected
mcgill
- loris
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')