What is the CVSS score of CVE-2026-42538?

CVE-2026-42538 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42538?

Yes, a patch is available for CVE-2026-42538. Update the affected software to the latest version immediately.

DFIR-IRIS CVE-2026-42538

EUVD-2026-34326 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-27

Information Disclosure File Upload Open Redirect

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 04, 2026 - 22:01 EUVD

Analysis Generated

Jun 04, 2026 - 21:22 vuln.today

CVSS changed

Jun 04, 2026 - 21:22 NVD

6.3 (MEDIUM)

CVE Published

May 27, 2026 - 20:45 nvd

MEDIUM 6.3

CVE Published

May 27, 2026 - 20:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Insecure file upload in DFIR-IRIS before version 2.4.28 allows a low-privileged remote attacker to upload files of dangerous types, resulting in high confidentiality impact and limited integrity compromise when a victim user interacts with the uploaded content. Disclosed by SBA Research in advisory SBA-ADV-20260126-03, this is one of three CVEs (CVE-2026-42329, CVE-2026-42538, CVE-2026-42539) patched simultaneously in the 2.4.28 release. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

DFIR-IRIS is a collaborative open-source web platform used by digital forensics and incident response teams to manage cases, share artifacts, and coordinate investigations. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the application does not adequately validate or restrict file types submitted via its upload functionality. This class of vulnerability commonly arises when server-side MIME-type or extension validation is absent or bypassable, allowing attackers to stage malicious file payloads within the application. The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates the upload endpoint is network-accessible, requires only low-privilege credentials, operates at low complexity, but requires a secondary user to interact with the uploaded artifact to realize the full confidentiality impact. The scope is unchanged (S:U), suggesting the compromise is contained to the application's trust boundary rather than breaking out to the underlying host.

RemediationAI

The primary fix is to upgrade DFIR-IRIS to version 2.4.28 or later, which addresses this insecure file upload alongside CVE-2026-42329 (Open Redirect) and CVE-2026-42539 (Excessive Data Exposure). The vendor advisory is available at https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m624-7744-2mhf. If immediate patching is not feasible, compensating controls should include restricting access to file upload endpoints to trusted, named analyst accounts only - minimizing the pool of PR:L accounts that could stage a malicious upload. Additionally, disabling or auditing file preview and download features that trigger user interaction with uploaded artifacts reduces the UI:R exploitation path. Network-level controls such as restricting DFIR-IRIS access to VPN or internal networks reduce exposure of the AV:N attack vector. Note that these controls reduce risk but do not eliminate the underlying CWE-434 flaw; patching remains the authoritative remediation.