Description
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dfir-iris | iris-web | 2.4.26 | — |
High · 7.6
CVE-2026-18361
EUVD-2026-51071GHSA-gj4w-mr87-6c67
DFIR-IRIS Stored XSS in Datastore Upload
Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by sba-research