CVE-2026-42538: medium-severity vulnerability in dfir-iris iris-web
IRIS has an Insecure File Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.2%
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Affected products
dfir-iris · iris-webRelated CVEs — dfir-iris iris-web
In the same product, most dangerous first.
CVE-2024-25624MEDIUMiris-web vulnerable to Server Side Template Injection in reportsEPSS 0.9%CVE-2026-92605HIGHIRIS through 2.4.29 Unauthorized Comment Access via Object IDEPSS 0.4%CVE-2023-30615MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-webEPSS 0.4%CVE-2026-18362MEDIUMDFIR-IRIS Missing Brute Force Protection in User AuthenticationEPSS 0.4%CVE-2026-22783CRITICALIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File ManagementEPSS 0.4%CVE-2024-25640MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-webEPSS 0.3%