What is the CVSS score of CVE-2026-42539?

CVE-2026-42539 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42539?

Yes, a patch is available for CVE-2026-42539. Update the affected software to the latest version immediately.

DFIR-IRIS CVE-2026-42539

EUVD-2026-34327 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-05-27

Information Disclosure File Upload Open Redirect

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 04, 2026 - 23:01 EUVD

Analysis Generated

Jun 04, 2026 - 22:23 vuln.today

CVSS changed

Jun 04, 2026 - 22:22 NVD

6.5 (MEDIUM)

CVE Published

May 27, 2026 - 20:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Excessive data exposure in DFIR-IRIS before version 2.4.28 enables authenticated low-privileged users to retrieve sensitive information from API responses that should be restricted or filtered server-side. The flaw (CWE-201) is part of a coordinated multi-vulnerability disclosure by SBA Research (SBA-ADV-20260126-04), which also identified an Open Redirect (CVE-2026-42329), Insecure File Upload (CVE-2026-42538), and Mass Assignment (CVE-2026-42540) in the same product version. No public exploit identified at time of analysis and no CISA KEV listing; however, the target platform stores highly sensitive digital forensics and incident response case data, elevating the practical impact of any confidentiality breach.

Technical ContextAI

DFIR-IRIS (iris-web) is an open-source, web-based case management platform used by digital forensics and incident response teams, commonly housing sensitive artifacts such as malware samples, forensic evidence, case timelines, and victim data. CWE-201 (Insertion of Sensitive Information Into Sent Data) describes a class of vulnerability where application responses - typically API endpoints - return data beyond what is necessary for the requesting user's role or context, such as unexpurgated records, internal metadata, debug fields, or cross-tenant data. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates the flaw is remotely exploitable over a network with low attack complexity, requires only low-privilege authentication, and has no user interaction requirement, with a high confidentiality impact but no integrity or availability impact. The SBA Research audit uncovered multiple related weaknesses simultaneously, suggesting systematic input/output handling deficiencies across the codebase. CPE strings are not explicitly provided in the available data.

RemediationAI

Upgrade DFIR-IRIS to version 2.4.28 or later, which resolves this vulnerability along with the related issues disclosed in the same SBA Research advisory batch: CVE-2026-42329 (Open Redirect), CVE-2026-42538 (Insecure File Upload), CVE-2026-42540 (Mass Assignment), and CVE-2026-42543. The vendor security advisory is available at https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx and the oss-security disclosure is at https://www.openwall.com/lists/oss-security/2026/05/19. As a compensating control prior to patching, restrict network access to the DFIR-IRIS instance via firewall rules or VPN so only authorized IR personnel can authenticate - this limits the pool of potential authenticated exploiters. Additionally, enforce least-privilege access controls and audit existing low-privilege accounts to remove unnecessary access. Note that network restriction does not remediate the underlying data exposure flaw and should not substitute for patching.