Description
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dfir-iris | iris-web | 2.4.26 | — |
High · 7.6
CVE-2026-18360
EUVD-2026-51070GHSA-fxc2-748w-pcjx
DFIR-IRIS Stored XSS in Custom Attributes
Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by sba-research