CVE-2026-42538
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.
Risk Assessment
An attacker can host malicious content on a trusted domain, facilitating phishing attacks and credential theft.
Recommendation
Update IRIS to version 2.4.28 or later.
Other vulnerabilities in IRIS
See all- CVE-2026-18362Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
- CVE-2026-18360High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
- CVE-2026-16971Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- CVE-2026-16970Medium
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
- CVE-2026-16969High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
- CVE-2026-42547Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
- CVE-2026-42543Medium
IRIS platform prior to version 2.4.28 is vulnerable to a CSRF attack because it uses the HTTP GET method to change server state. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
- CVE-2026-42540Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests.
- CVE-2026-42539Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
- CVE-2026-42329Medium
Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.
Original NVD description (English source)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.