Description
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dfir-iris | iris-web | 2.4.26 | — |
High · 7.6
CVE-2026-16969
EUVD-2026-51069GHSA-fcp4-m28j-rjrq
DFIR-IRIS Stored XSS in Assets
Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by sba-research