What is the CVSS score of CVE-2026-42329?

CVE-2026-42329 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-42329?

Yes, a patch is available for CVE-2026-42329. Update the affected software to the latest version immediately.

DFIR-IRIS CVE-2026-42329

EUVD-2026-34325 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-05-27

File Upload Open Redirect

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 04, 2026 - 22:01 EUVD

Analysis Generated

Jun 04, 2026 - 21:23 vuln.today

CVSS changed

Jun 04, 2026 - 21:22 NVD

4.7 (MEDIUM)

CVE Published

May 27, 2026 - 20:45 nvd

MEDIUM 4.7

CVE Published

May 27, 2026 - 20:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Open redirect in DFIR-IRIS before version 2.4.28 allows unauthenticated remote attackers to craft URLs that silently redirect authenticated users to arbitrary external domains. The CVSS Scope:Changed (S:C) component confirms the vulnerability crosses the application's trust boundary, making it a viable vector for phishing and credential harvesting campaigns targeting incident responders and forensic analysts who use the platform. No public exploit code or active exploitation has been identified at time of analysis, and no CISA KEV listing is present.

Technical ContextAI

DFIR-IRIS is an open-source web-based collaborative incident response platform (iris-web on GitHub). The root cause is classified as CWE-602 (Client-Side Enforcement of Server-Side Security), which indicates that redirect destination validation is implemented in client-side logic - such as JavaScript - rather than being enforced authoritatively on the server. This allows an attacker to craft a request that bypasses the client-side allowlist or validation check entirely, as the server does not independently verify that the redirect target is a trusted domain before issuing the redirect response. The CVSS Scope:Changed value is consistent with open redirect behavior, where the vulnerable web component causes the user's browser to cross into a separate, attacker-controlled security domain. The fix is tracked in the GitHub Security Advisory GHSA-vjc3-7jwv-j9qf and was introduced in version 2.4.28.

RemediationAI

The primary fix is to upgrade DFIR-IRIS to version 2.4.28 or later, which resolves the open redirect per the SBA Research advisory [SBA-ADV-20260126-02] and the GitHub Security Advisory GHSA-vjc3-7jwv-j9qf at https://github.com/dfir-iris/iris-web/security/advisories/GHSA-vjc3-7jwv-j9qf. If an immediate upgrade is not feasible, a compensating control is to deploy a reverse proxy or WAF rule that intercepts redirect responses from the application and validates the Location header against a strict allowlist of trusted domains before forwarding to the client; note this may break legitimate redirect flows and requires careful allowlist construction. Additionally, restricting DFIR-IRIS access to internal networks or VPN-only reduces the attack surface by preventing external delivery of crafted links, though it does not eliminate the vulnerability if internal users can be socially engineered.