CVE-2026-18360: IRIS Web Application XSS Vulnerability

CVE-2026-18360 Overview

CVE-2026-18360 is a stored cross-site scripting (XSS) vulnerability in the DFIR-IRIS web application. The flaw affects version 2.4.26 and possibly other releases. The vulnerability resides in the custom attributes function, which fails to properly sanitize user-supplied input before rendering it to other users.

An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of other IRIS users. Because IRIS is a Digital Forensics and Incident Response (DFIR) collaboration platform, successful exploitation can compromise investigation data and analyst sessions.

Critical Impact

Stored JavaScript executes in analyst browsers with a scope change, enabling session theft, forced actions, and manipulation of forensic case data [CWE-79].

Affected Products

• DFIR-IRIS version 2.4.26
• Earlier DFIR-IRIS 2.x releases (potentially affected)
• Any IRIS deployment exposing the custom attributes function to untrusted users

Discovery Timeline

• 2026-07-30 - CVE-2026-18360 published to the National Vulnerability Database (NVD)
• 2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18360

Vulnerability Analysis

DFIR-IRIS allows users to define custom attributes on case objects such as IOCs, assets, notes, and events. The custom attributes function accepts user-controlled content and later renders it in the IRIS web interface. The application does not adequately encode or filter this input before insertion into the Document Object Model (DOM).

Because the payload is stored server-side, every user who views the affected object triggers execution of the attacker-controlled script. The CVSS vector indicates the scope changes on successful exploitation, meaning the injected script can affect components beyond the vulnerable one, such as parent frames or authenticated API sessions.

Exploitation requires authenticated access with low privileges and user interaction from a victim analyst. The confidentiality impact is high because JavaScript running in an IRIS session can exfiltrate case details, credentials, and API tokens.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The custom attributes handler stores raw user input and returns it to the client without contextual output encoding, allowing HTML and script content to break out of the intended data context.

Attack Vector

An authenticated attacker submits a crafted payload through the custom attributes function on any object type that supports them. When another IRIS user opens the affected case, IOC, or asset view, the browser parses the attacker's HTML and executes the embedded JavaScript under the victim's origin. The attacker can then issue authenticated requests, capture DFIR case content, or pivot to other users via the shared collaboration model.

See the GitHub Security Advisory for the full technical write-up.

Detection Methods for CVE-2026-18360

Indicators of Compromise

• Custom attribute values containing HTML tags such as <script>, <img onerror=>, or <svg onload=>
• Outbound requests from analyst browsers to unfamiliar domains shortly after opening an IRIS case
• Unexpected API calls to IRIS endpoints originating from analyst sessions

Detection Strategies

• Query the IRIS database for stored custom attribute values matching HTML or JavaScript patterns
• Review web server access logs for POST requests to custom attribute endpoints containing encoded angle brackets or event handlers
• Alert on Content Security Policy (CSP) violation reports if CSP is enabled on the IRIS deployment

Monitoring Recommendations

• Monitor authenticated IRIS user activity for anomalous session behavior, especially privileged accounts
• Track creation and modification events on custom attributes across cases, IOCs, and assets
• Correlate browser telemetry from analyst workstations with IRIS access logs to identify suspicious script execution

How to Mitigate CVE-2026-18360

Immediate Actions Required

• Restrict custom attribute creation and modification to trusted administrator accounts until a patch is applied
• Audit existing custom attribute values in the IRIS database and remove any containing HTML or scripting content
• Rotate IRIS user session tokens and API keys if suspicious activity is identified

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the DFIR-IRIS GitHub Security Advisory and the upstream DFIR-IRIS project for release notes addressing the custom attributes function. Upgrade beyond version 2.4.26 as soon as a fixed release becomes available.

Workarounds

• Deploy a strict Content Security Policy on the IRIS web server to block inline script execution
• Place IRIS behind a Web Application Firewall (WAF) configured to filter script tags and event handler attributes in request bodies
• Limit IRIS access to trusted network segments and enforce multi-factor authentication for all analyst accounts

# Example nginx CSP header to reduce XSS impact on IRIS deployments
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;