Read the docs
TI-2026-18301 Aliases CVE-2026-22783

Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management

Priority MEDIUM 41CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution, Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434 and CWE-915.

Summary

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Fixed iris-web (dfir-iris): 2.4.24

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dfir-irisiris-webbefore 2.4.242.4.24Patch availableCNA
  • iris-web Vendordfir-iris Affected before 2.4.24 Fixed in 2.4.24 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*before 2.4.24Vulnerabledfir-iris
  • cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:* Versions before 2.4.24 Vulnerable ·dfir-iris

Remediation

  • Fix · CNA iris-web (dfir-iris) Fixed in 2.4.24

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22783

References

Patch 1

Advisory 1

  • TI-2024-16852 iris-web vulnerable to Server Side Template Injection in reports CVSS 3.1MEDIUM 6.8
  • TI-2023-14431 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web CVSS 3.1MEDIUM 6.3
  • TI-2024-16868 Improper Neutralization of Alternate XSS Syntax in iris-web CVSS 3.1MEDIUM 5.4
  • TI-2023-27658 Improper Neutralization of Alternate XSS Syntax in iris-web CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences