PT-2026-46385 · Dfir Iris · Iris-Web

Mkoppmann + 1 · Publicado 2026-06-04 · Atualizado 2026-06-04 · CVE-2026-42538

NVD

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-42538

Produtos afetados

Iris-Web

Referências · 3

• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m624-7744-2mhf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42538 · Nota de Segurança
• http://openwall.com/lists/oss-security/2026/05/19/8 · Nota