The vulnerability exists in the help_editor module of Loris, a self‑hosted web application for neuroimaging research. Versions before 27.0.3 (in the 27 series) and before 28.0.1 (in the 28 series) fail to sanitize certain user‑supplied variables. This flaw allows a reflected cross‑site scripting (XSS) attack if a user follows a maliciously crafted link. The same input path also lets an attacker download arbitrary markdown files from an unpatched server.

The issue affects installations of Loris running versions older than 27.0.3 or 28.0.1. The vendor "aces" has released patch versions that include the sanitization fix. No explicit deployment environment is documented, but the application is typically self‑hosted.

The CVSS score of 8.7 indicates a high‑severity flaw that is potentially exploitable via a web‑based request to the help_editor endpoint. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be a legitimate Loris user who clicks a crafted URL; the attacker can then execute arbitrary JavaScript in the victim’s browser and obtain markdown files, compromising confidentiality and enabling further exploitation of the hosting environment.