CVE-2024-34060: Arbitrary File Write in IRIS EVTX Pipeline

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-23 · updated 2026-06-17
Weakness: CWE-22

Description

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.

Affected products

dfir-iris iris-evtx-module: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: dfir-iris iris-evtx-module 1.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-34060 or the next vulnerability affects your stack