EUVD-2026-51069
GHSA-fcp4-m28j-rjrq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Stored XSS needs an authenticated low-priv account (PR:L) and a victim view (UI:R); script executes cross-context in the browser (S:C) enabling session/case-data theft (C:H) with limited integrity impact (I:L).
Primary rating from Vendor (sba-research).
CVSS VectorVendor: sba-research
Lifecycle Timeline
2DescriptionCVE.org
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
AnalysisAI
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).
Technical ContextAI
DFIR-IRIS (CPE cpe:2.3:a:dfir-iris:iris-web) is an open-source, collaborative digital-forensics and incident-response case-management web application used by SOC and DFIR teams to track investigations, evidence, and assets. The flaw is a CWE-79 Improper Neutralization of Input During Web Page Generation (stored/persistent XSS): user-supplied data submitted through the assets function is stored server-side and later rendered into HTML without adequate output encoding or sanitization, so an attacker-controlled string is interpreted as executable script in the context of the IRIS origin. Being stored (not reflected) means the payload fires automatically for every user who opens the affected asset view, without any per-victim crafting.
RemediationAI
No vendor-released patch version is identified in the available data, so upgrade to the latest DFIR-IRIS iris-web release and consult the SBA Research advisory (https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260126-01_DFIR-IRIS_Stored_XSS) and the DFIR-IRIS project releases for a fixed build before deploying. As compensating controls until a confirmed patch is applied, restrict who can create or edit assets by tightening IRIS role permissions so only trusted analysts can populate asset fields (trade-off: reduces collaborative data entry), and deploy a strict Content-Security-Policy that disallows inline script execution on the IRIS origin to blunt payload execution (trade-off: may break legitimate inline UI scripts and require testing). Additionally, audit existing asset entries for injected script before it is viewed by privileged users, and place IRIS behind network access controls so only authenticated internal responders can reach it.
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privi
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an a
Missing brute-force protection on the DFIR-IRIS web application's authentication endpoint exposes version 2.4.26 (and po
Missing rate-limiting on MFA validation in DFIR-IRIS 2.4.26 allows a remote attacker who possesses valid user credential
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session coo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today