This vulnerability arises from a path‑traversal flaw in LORIS’s electrophysiology_browser module, permitting an authenticated user with sufficient privileges to read arbitrary configuration files on the server. Some of these files contain hard‑coded credentials that can grant access to the database or other internal services. The primary effect is the disclosure of sensitive data that could be used to compromise additional components and services.

The issue impacts the LORIS application released by aces. Versions beginning at 24.0.0 and up to, but not including, 26.0.5, 27.0.2, and 28.0.0 are vulnerable. The patched releases are 26.0.5, 27.0.2, and 28.0.0 or later.

The CVSS score of 8.1 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation has not been widespread. Because the attacker must be authenticated and possess the appropriate permissions, the flaw is not openly exploitable; however, the straightforward path‑traversal code and publicly available source make it trivial for a determined insider or compromised account to read the files. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits yet, yet the risk remains significant if configuration files contain reused credentials. The simplest exploitation chain is: authenticated user → module access → path traversal → arbitrary file read.