CVE-2026-42329: Iris has an Open Redirect issue

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-04 · updated 2026-07-22
Weakness: CWE-602

Description

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 contain a weakness where an attacker can misuse it to redirect the user to a malicious website controlled by an attacker. Version 2.4.28 fixes the issue.

Affected products

dfir-iris iris-web: before 2.4.28

References

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-vjc3-7jwv-j9qf
http://www.openwall.com/lists/oss-security/2026/05/19/7
https://github.com/dfir-iris/iris-web/security/advisories/GHSA-vjc3-7jwv-j9qf

Get alerted when CVE-2026-42329 or the next vulnerability affects your stack