CVE-2026-39985— LORIS has an open redirect field on login
Quick assessment
Affected
aces Loris
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LORIS Neuroimaging Platform是ACElab开源的一个神经影像平台。 LORIS Neuroimaging Platform 27.0.3之前版本和28.0.1之前版本存在输入验证错误漏洞，该漏洞源于登录重定向参数未验证目标是否在LORIS内，可能导致用户被诱导访问任意URL。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39985
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LORIS has an open redirect field on login
Source: CVE Program / CVE List V5
Vulnerability Description
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
LORIS Neuroimaging Platform 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LORIS Neuroimaging Platform是ACElab开源的一个神经影像平台。 LORIS Neuroimaging Platform 27.0.3之前版本和28.0.1之前版本存在输入验证错误漏洞，该漏洞源于登录重定向参数未验证目标是否在LORIS内，可能导致用户被诱导访问任意URL。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-39985
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39985
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-39985 (1)
-
Merge commit from fork · aces/Loris@f57f54b · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: Loris
-
CVE-2026-35446
LORIS has a path traversal in FilesDownloadHandler -
CVE-2026-35403
LORIS has potential cross-site scripting in survey_accounts -
CVE-2026-35400
LORIS incorrectly trusts user input in publication module -
CVE-2026-35169
LORIS has potential cross-site scripting in help_editor modu -
CVE-2026-35165
LORIS has incorrect access checks in document_repository
Same vendor: aces
-
CVE-2026-35446
LORIS has a path traversal in FilesDownloadHandler -
CVE-2026-35403
LORIS has potential cross-site scripting in survey_accounts -
CVE-2026-35400
LORIS incorrectly trusts user input in publication module -
CVE-2026-35169
LORIS has potential cross-site scripting in help_editor modu -
CVE-2026-35165
LORIS has incorrect access checks in document_repository
Same weakness: CWE-601
-
CVE-2026-39600
WordPress Aculect AI Companion plugin <= 0.8.1 - Unvalidated -
CVE-2026-55252
OpenRun: Redirect URL validation bypass using //host paths -
CVE-2026-83589
Oauth-proxy: open redirect via /\ and /\t bypass in post-log -
CVE-2026-102090
Kiteworks Core content injection -
CVE-2026-103048
Open Redirect in Special:Book
V. Comments for CVE-2026-39985
No comments yet