Threats affecting pkg:github/sbaresearch/iris-web

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

CVE-2026-18362 affects the IRIS web application version 2.4.26 and possibly other versions. The vulnerability involves the lack of protection against brute-force attacks on user authentication, categorized under CWE-770 for allocation of resources without limits or throttling. This can allow an attacker to attempt numerous authentication attempts without restriction. The CVSS score is 5.9, indicating a medium severity level.

CVE-2026-16971 is a medium severity vulnerability in the dfir-iris iris-web application version 2.4.26. The vulnerability involves insufficient protection of the multi-factor authentication (MFA) validation process against brute-force attacks, classified under CWE-770 for allocation of resources without limits or throttling. This flaw could allow an attacker to attempt numerous MFA validation requests without effective rate limiting. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its datastore upload function. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 7.6, indicating high severity.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its custom attributes function. This vulnerability allows an attacker with low privileges and requiring user interaction to execute scripts in the context of another user. The vulnerability impacts confidentiality and integrity but does not affect availability. No official patch or remediation guidance is currently available.

The IRIS web application version 2.4.26 contains a stored cross-site scripting (XSS) vulnerability in its assets function. This vulnerability allows an attacker with low privileges and requiring user interaction to execute scripts in the context of other users, potentially leading to high confidentiality impact and limited integrity impact. The vulnerability has a CVSS score of 7.6, indicating high severity. No official patch or remediation guidance is currently available from the vendor.