Critical · published January 12, 2026
🚨 An authenticated user can effectively erase any file on the server without breaking a sweat! 🔥 Think of it like a restaurant where a customer can not only order a dish but also change the name on the menu to something entirely different and then ask the chef to remove it — no questions asked! This vulnerability could lead to complete chaos, allowing malicious actors to delete crucial files from the filesystem, potentially crippling incident response efforts and leaving sensitive information vulnerable. Imagine your colleagues scrambling to recover after critical evidence has vanished without a trace!
Think of it like a restaurant where a customer can not only order a dish but also change the name on the menu to something entirely different and then ask the chef to remove it — no questions asked! In this critical vulnerability, the DFIR-IRIS datastore file management system allows mass assignment of the 'file_local_name' field, which lets authenticated users manipulate arbitrary filesystem paths. This leads to unauthorized file deletion due to a lack of proper path validation during the delete operation.
This vulnerability could lead to complete chaos, allowing malicious actors to delete crucial files from the filesystem, potentially crippling incident response efforts and leaving sensitive information vulnerable. Imagine your colleagues scrambling to recover after critical evidence has vanished without a trace! Update your DFIR-IRIS platform immediately to version 2.4.24 to close this glaring loophole. Ensure to review permissions for authenticated users to limit their access to sensitive operations until the patch is applied. You've got this! With these steps, you're well on your way to securing your system and protecting vital data. 🛡️