CVE-2026-42538: IRIS has an Insecure File Upload

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-04 · updated 2026-07-22
Weakness: CWE-434

Description

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.

Affected products

dfir-iris iris-web: before 2.4.28

References

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m624-7744-2mhf
http://www.openwall.com/lists/oss-security/2026/05/19/8
https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m624-7744-2mhf

Get alerted when CVE-2026-42538 or the next vulnerability affects your stack