What is the CVSS score of CVE-2026-18361?

CVE-2026-18361 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of DFIR-IRIS are affected by CVE-2026-18361?

DFIR-IRIS (iris-web v2.4.26 and earlier) contains a stored cross-site scripting vulnerability that allows low-privileged users to inject malicious scripts into the datastore, which then execute when…

How to fix or mitigate CVE-2026-18361?

Within 24 hours, audit all datastore uploads in DFIR-IRIS for suspicious or unusual content and restrict datastore upload access to a minimal trusted group pending remediation. Within 7 days, implement strict input validation and output encoding on all datastore uploads, deploy Content Security Policy (CSP) headers to restrict script execution, and consider temporarily disabling the datastore upload function if not critical to operations. Within 30 days, monitor the vendor's security advisories for a patch to v2.4.27 or later, conduct a security review of all existing datastores for injected payloads, and plan an upgrade to a patched version once available.

DFIR-IRIS CVE-2026-18361

EUVD-2026-51071 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 sba-research

GHSA-gj4w-mr87-6c67

XSS Iris Web Dfir Iris

7.6

CVSS 3.1 · Vendor: sba-research

Severity by source

Vendor (sba-research) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Authenticated upload access sets PR:L, stored payload needs a victim to view it so UI:R, and script running in another user's session gives S:C with C:H and limited I:L.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (sba-research).

CVSS VectorVendor: sba-research

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 10:20 vuln.today

CVE Published

Jul 30, 2026 - 09:42 cve.org

HIGH 7.6

DescriptionCVE.org

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

AnalysisAI

Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).

Technical ContextAI

DFIR-IRIS is a collaborative digital-forensics and incident-response (DFIR) case-management web application (CPE cpe:2.3:a:dfir-iris:iris-web). The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: data submitted via the datastore upload feature - used by analysts to attach and share evidence/files within a case - is persisted and later rendered without adequate output encoding or sanitization, so attacker-supplied HTML/JavaScript is stored server-side and executed when another user's browser loads the tainted view. As a stored (persistent) rather than reflected variant, exploitation does not require tricking the victim into clicking a crafted external link; simply viewing the poisoned datastore entry within the trusted application triggers the payload.

RemediationAI

No vendor-released patch identified at time of analysis; the only reference is the SBA Research advisory (https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260126-01_DFIR-IRIS_Stored_XSS), so administrators should monitor the DFIR-IRIS project (dfir-iris/iris-web) for a fixed release beyond 2.4.26 and upgrade as soon as one is published. As compensating controls, restrict datastore upload permissions to trusted analysts only and review who holds low-privileged accounts, since exploitation requires an authenticated user; deploy a strict Content-Security-Policy that disallows inline script execution to blunt payload execution in victim browsers (trade-off: may break legitimate inline scripting in the app and require testing); and place the IRIS instance behind network access controls or a WAF that filters script markup in uploaded content, accepting that a WAF cannot reliably catch all stored-XSS encodings. Treat existing datastore entries as potentially tainted and audit them before a fix is applied.