CVE-2026-42539: IRIS has an Excessive Data Exposure issue

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-04 · updated 2026-07-22
Weakness: CWE-201

Description

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

Affected products

dfir-iris iris-web: before 2.4.28

References

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx
http://www.openwall.com/lists/oss-security/2026/05/19/9
https://github.com/dfir-iris/iris-web/security/advisories/GHSA-g588-5gmf-p5cx

Get alerted when CVE-2026-42539 or the next vulnerability affects your stack