What is the CVSS score of CVE-2026-18360?

CVE-2026-18360 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of DFIR-IRIS are affected by CVE-2026-18360?

DFIR-IRIS iris-web 2.4.26 contains a stored cross-site scripting vulnerability in the custom attributes function that allows authenticated users to inject persistent malicious scripts affecting other…

How to fix or mitigate CVE-2026-18360?

Within 24 hours, inventory all DFIR-IRIS deployments running version 2.4.26 or earlier and verify user access levels to the custom attributes function. Within 7 days, implement the interim mitigations listed below (input validation, output encoding, CSP enforcement, and custom attributes function restriction) and conduct a forensic review of IRIS audit logs for evidence of exploitation or suspicious JavaScript injection in custom attributes. Within 30 days, monitor the SBA Research advisory (SBA-ADV-20260126-01) and vendor security announcements for a vendor-released patch; upon patch availability, immediately test and deploy to all IRIS instances, prioritizing environments handling the most sensitive investigations.

DFIR-IRIS CVE-2026-18360

EUVD-2026-51070 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 sba-research

GHSA-fxc2-748w-pcjx

XSS Iris Web Dfir Iris

7.6

CVSS 3.1 · Vendor: sba-research

Severity by source

Vendor (sba-research) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Authenticated low-priv injection (PR:L) with victim interaction (UI:R) and scope change (S:C) as script runs in the victim's browser; session/data theft yields C:H, minor DOM manipulation I:L, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (sba-research).

CVSS VectorVendor: sba-research

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 10:20 vuln.today

CVE Published

Jul 30, 2026 - 09:41 cve.org

HIGH 7.6

DescriptionCVE.org

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

AnalysisAI

Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.

Technical ContextAI

DFIR-IRIS (iris-web) is an open-source, web-based collaborative platform used by incident-response teams to manage cases, evidence, IOCs, and timelines. The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS in the 'custom attributes' feature, which allows users to define and populate arbitrary metadata fields on IRIS objects. Input supplied to these custom attributes is persisted server-side and rendered back into the application UI without adequate output encoding or sanitization, so attacker-controlled markup/script is stored and executed in the context of every user who views the object. The affected CPE is cpe:2.3:a:dfir-iris:iris-web:*:*:*:*:*:*:*:*, with version 2.4.26 explicitly named and earlier versions likely affected.

RemediationAI

No vendor-released patch version was identified in the available data, so upgrade to the latest DFIR-IRIS iris-web release beyond 2.4.26 once the maintainers publish a fixed build, and consult the SBA Research advisory at https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260126-01_DFIR-IRIS_Stored_XSS for coordinated fix details. As compensating controls until a patch is confirmed, restrict who can create or edit custom attributes to trusted, vetted accounts (reducing the pool of potential injectors, at the cost of collaboration flexibility), tighten a Content-Security-Policy to disallow inline script execution in the IRIS web UI (which can break legitimate inline scripts and requires testing), and audit existing custom attribute values for embedded HTML/JavaScript before privileged users view them. Because exploitation requires an authenticated account, enforcing least-privilege roles and monitoring account activity limits the attack surface.