Stored XSS in IRIS Web Application

Executive Summary

CVE-2026-16969 is a stored cross-site scripting (XSS) vulnerability in the DFIR-IRIS web application version 2.4.26 and possibly others. The issue occurs in the assets function where user input in asset names and descriptions is not properly sanitized when displayed in customer settings. This allows attackers to inject malicious JavaScript that executes in victims' browsers when they view these settings.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the DFIR-IRIS application version 2.4.26 or similar for stored XSS in the assets function. Check if user-supplied input in asset names and descriptions is rendered without proper output encoding in customer settings. Manually test by entering JavaScript payloads like <script>alert(1)</script> in asset fields and verify if they execute when viewing customer settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal session cookies, hijack user sessions, or take over the application, especially if an administrator is targeted. The malicious script runs in the context of the victim's browser, potentially leading to unauthorized actions or data theft.

Useful 0 Not Useful 0

Compliance Impact

Stored XSS vulnerabilities can lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if user data is exposed or altered due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Implement strict output encoding for all user-supplied data in the application. Use template engines to ensure consistent encoding. Harden the Content Security Policy by removing unsafe-inline directives. Monitor for suspicious activity in customer settings where the vulnerability may be exploited.

Useful 0 Not Useful 0