Is CVE-2026-34392 actively exploited?

No active exploitation of CVE-2026-34392 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34392 be exploited remotely?

Yes. CVE-2026-34392 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34392?

CVE-2026-34392 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-34392

HIGH

CVE-2026-34392

CWE-552Published: April 8, 2026· Updated: Apr 8, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.9th

Official Description

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.

NVD Source

Technical Analysis

CVE-2026-34392 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.