LORIS’s FilesDownloadHandler processes download requests with an incorrect order of operations, allowing attackers to escape the intended download directories via crafted URLs. The result is the ability to download arbitrary files stored on the web server, potentially exposing sensitive project data, configuration files, or user credentials to any attacker who can access the application. This flaw falls under CWE‑552 and carries a CVSS score of 7.7, indicating high severity and a significant threat to confidentiality.

The vulnerability affects LORIS 24.0.0, all releases up to before 27.0.3, and 28.0.1. These are self‑hosted instances used for neuroimaging research that provide data and project management. All affected installations may allow unauthorized file download unless upgraded to the patched versions.

With a CVSS score of 7.7 the risk is high, and because the flaw is exploitable by sending a specially crafted request from any network segment that can reach the application, the attack vector is inferred to be remote over HTTP. No EPSS information is available, but the lack of authentication requirements and the straightforward request pattern suggest a high likelihood of exploitation in exposed environments. The vulnerability is not listed in the CISA KEV catalog, but its potential impact justifies immediate attention.