The publication module in the web application accepts a user‑supplied baseURL from a POST request instead of the internally configured value. This flaw allows an attacker with access to the publication module to direct automated emails to an external domain of the attacker’s choosing. The resulting emails will appear to originate from the application, enabling phishing or social‑engineering attacks against internal users. The weakness corresponds to CWE‑59, where untrusted input influences address resolution.

LORIS versions from 20.0.0 up to, but not including, 27.0.3 and the 28.0.0 release are vulnerable. The fix is available in 27.0.3 and in 28.0.1 and later releases.

The CVSS score of 3.5 indicates low severity, and no EPSS data is available; the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker first obtain authenticated access to the publication module, which typically means having valid user credentials or the ability to create a publication. Once such access is achieved, the attacker can modify the baseURL to send spoofed emails. The risk is confined to environments where users trust emails sent from the application; exploitation without user interaction is unlikely, but the potential for phishing remains.