CVE-2026-42538CWE-434

IRIS has an Insecure File Upload

Medium · published June 4, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-06-04T20:48Z
EPSS history
Timeline
  • 04 JUN 20:48Z
    IRIS has an Insecure File Upload
    cvelistv5