Arbitrary File Write in IRIS EVTX Pipeline
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA iris-evtx-module (dfir-iris) Fixed in 1.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34060
References
More dfir-iris vulnerabilities
- TI-2026-15096 DFIR-IRIS Stored XSS in Datastore Upload CVSS 3.1HIGH 7.6
- TI-2026-14129 DFIR-IRIS Stored XSS in Assets CVSS 3.1HIGH 7.6
- TI-2026-30819 IRIS has an Excessive Data Exposure issue CVSS 3.1MEDIUM 6.5
- TI-2026-30818 IRIS has an Insecure File Upload CVSS 3.1MEDIUM 6.3
- TI-2026-30827 IRIS Alerts Can be Falsely Attributed to Customers CVSS 3.1MEDIUM 5.4
- TI-2026-30635 Iris has an Open Redirect issue CVSS 3.1MEDIUM 4.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences