CVE-2026-33350-nvd.nist.gov-Received

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. P…

Published:

7 April 2026 at 22:00:00

Alert date:

8 April 2026 at 20:02:46

Source:

nvd.nist.gov

Web Technologies, Enterprise Applications, Database & Storage

A SQL injection vulnerability has been identified in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application for neuroimaging research data management. The vulnerability affects the MRI feedback popup window in the imaging browser component. Attackers can exploit this SQL injection to access or alter data on the server. The vulnerability affects versions prior to 27.0.3 and 28.0.1, and has been fixed in these versions.

Technical details

Mitigation steps:

Affected products:

LORIS