The vulnerability originates from a path‑traversal flaw in LORIS's media module that allows an authenticated user with sufficient privileges to upload a file to any directory on the server. Because the application does not sanitize the supplied path, a malicious file can be placed on the filesystem and later executed, providing remote code execution on the host. The flaw also permits unrestricted file uploads, which can be abused even if the server is set to read‑only, although RCE would be blocked in that scenario.

McGill's LORIS, a self‑hosted web platform for neuroimaging research, is affected. Versions older than 26.0.5, 27.0.2, and 28.0.0 contain the flaw. The application relies on the media module to manage project files, so any deployment of these versions that enables the module is vulnerable unless the module has been disabled or the system is run in read‑only mode.

The CVSS base score of 8.8 indicates high severity, while the EPSS score below 1% suggests a low probability of exploitation at present. Nevertheless, the attack requires only authentication and appropriate upload rights, which are normally granted to project administrators. An attacker who gains such access can leverage the flaw to run code, compromise data integrity, and potentially pivot to other systems. The issue is not listed in the CISA KEV catalog, but the combination of authenticated access and unrestricted file placement makes it a serious risk for any LORIS installation that has the media module enabled.