Read the docs
TI-2024-16852 Aliases CVE-2024-25624

iris-web vulnerable to Server Side Template Injection in reports

Priority LOW 34CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Successful exploitation of the vulnerability can lead to an arbitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the payload. Upon generation of a report based on the weaponized report, any user can trigger the vulnerability. The vulnerability is patched in IRIS v2.4.6. No workaround is available. It is recommended to update as soon as possible. Until patching, review the report templates and keep the administrative privileges that include the upload of report templates limited to dedicated users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00852 58th percentileScored 2026-11-07
Fix Fixed iris-web (dfir-iris): 2.4.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dfir-irisiris-webbefore 2.4.62.4.6Patch availableCNA
  • iris-web Vendordfir-iris Affected before 2.4.6 Fixed in 2.4.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*before 2.4.6Vulnerabledfir-iris
  • cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:* Versions before 2.4.6 Vulnerable ·dfir-iris

Remediation

  • Fix · CNA iris-web (dfir-iris) Fixed in 2.4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25624

References

Advisory 1

  • TI-2026-18301 Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management CVSS 3.1CRITICAL 9.6
  • TI-2023-14431 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web CVSS 3.1MEDIUM 6.3
  • TI-2024-16868 Improper Neutralization of Alternate XSS Syntax in iris-web CVSS 3.1MEDIUM 5.4
  • TI-2023-27658 Improper Neutralization of Alternate XSS Syntax in iris-web CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences