CVE-2026-18361 identifies a stored cross-site scripting (XSS) vulnerability in the IRIS web application (iris-web) version 2.4.26. The flaw arises from improper input neutralization in the datastore upload function, allowing malicious scripts to be stored and executed in the context of a victim's browser. The vulnerability has a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N), indicating network attack vector, low attack complexity, requiring low privilege and user interaction, with scope changed, high confidentiality impact, low integrity impact, and no availability impact. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation could lead to high confidentiality impact by exposing sensitive information accessible to the victim's browser session. The integrity impact is low, and availability is not affected. The vulnerability requires an attacker with low privileges and user interaction to trigger the stored XSS payload, which could compromise user data confidentiality within the affected application scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling untrusted input in the datastore upload function. Monitor vendor communications for updates on patches or mitigations. No official remediation or temporary fix has been documented at this time.