PT-2026-46385 · Iris · Iris

Mkoppmann + 1 · CVE-2026-42538 · Published 2026-06-04 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions IRIS versions prior to 2.4.28

Description IRIS is a web collaborative platform for incident responders to share technical details during investigations. The application fails to properly validate uploaded files, which allows the platform to be misused for hosting phishing pages. This flaw also enables Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 2.4.28.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-42538

GHSA-M624-7744-2MHF

Affected Products

Iris

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42538.json · Exploit
• 🔥 https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m624-7744-2mhf · Exploit
• https://osv.dev/vulnerability/CVE-2026-42538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42538 · Security Note
• http://openwall.com/lists/oss-security/2026/05/19/8 · Note