DFIR-IRIS Stored XSS Vulnerabilities (CVE-2026-16969, CVE-2026-18360, CVE-2026-18361) and POC

DFIR-IRIS Stored Cross-Site Scripting (XSS) Vulnerability Summary Vulnerability Overview Identifier: SBA-ADV-20260126-01 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Software/Product Name: IRIS Vendor: DFIR-IRIS Affected Version: 2.4.26 Fixed Version: Currently unavailable CVE ID: CVE-2026-16969, CVE-2026-18360, CVE-2026-18361 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Base Score: 7.6 (High) Impact Scope Vulnerability Description: - Assets (CVE-2026-16969): Asset names and descriptions can contain arbitrary HTML text. When displayed on the asset's "Assets" tab, proper output encoding is not applied, allowing for XSS attacks. - Custom Attributes (CVE-2026-18360): Administrators can automatically assign new attributes to object types. The URL path offers several input types, including HTML. Documentation has identified that the HTML type is vulnerable, but adequate protective measures have not been implemented. - Datastore Uploads (CVE-2026-18361): SVG files containing tags can be uploaded to the datastore. Impact: - JavaScript code controlled by the attacker will execute in the victim's browser when the user interacts with certain parts of the application. This can lead to session hijacking, sensitive information disclosure, and other consequences. Remediation Current Status: No fixed version is currently available. Recommended Actions: - Apply output encoding to asset names and asset descriptions. - Implement proper validation and filtering for HTML input within custom attributes. - Enforce strict type and content checks on uploaded files to prevent the execution of malicious scripts. Proof of Concept (POC) Code Assets (CVE-2026-16969) Custom Attributes (CVE-2026-18360) Datastore Upload (CVE-2026-18361)

Goal Reached Thanks to every supporter — we hit 100%!

DFIR-IRIS Stored XSS Vulnerabilities (CVE-2026-16969, CVE-2026-18360, CVE-2026-18361) and POC

More from this source