LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. F…

LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application for neuroimaging research data management, contains a directory traversal vulnerability in versions 24.0.0 to before 27.0.3 and 28.0.1. The vulnerability stems from an incorrect order of operations in the FilesDownloadHandler component that allows attackers to escape intended download directories. This could potentially allow unauthorized access to files outside the designated download areas. The vulnerability has been patched in versions 27.0.3 and 28.0.1.