A flaw in LORIS’s media module backend allows files that should be inaccessible to be retrieved if the attacker knows the filename, because the backend does not enforce the same access checks that the frontend applies. This delivers a path for unauthorized disclosure of potentially sensitive neuroimaging data, but does not enable code execution, privilege escalation, or denial of service.

The vulnerability affects the self-hosted LORIS web application, versions from 16.1.0 up to, but not including, 27.0.3 and 28.0.1. The issue is resolved in releases 27.0.3 and 28.0.1 and later. Users running affected versions should consult the vendor for upgrade availability.

The CVSS score is 6.3, indicating moderate severity. Exploitation requires only knowledge of a filename and access to the web interface; no elevated privileges are needed. Because the attack vector is over the web and the vulnerability is publicly known, the likelihood of exploitation is reasonable. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog.