CVE-2026-18361: IRIS Web Application XSS Vulnerability

CVE-2026-18361 Overview

CVE-2026-18361 is a stored cross-site scripting (XSS) vulnerability affecting the DFIR-IRIS web application version 2.4.26 and possibly earlier releases. The flaw resides in the datastore upload function, where user-supplied content is persisted without proper output encoding or sanitization. An authenticated attacker with upload privileges can inject malicious JavaScript that executes in the browser context of any user who later views the affected datastore entry. This vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of other IRIS users, potentially hijacking sessions and compromising sensitive incident response data.

Affected Products

DFIR-IRIS web application version 2.4.26
Earlier IRIS releases may also be affected
Deployments exposing the datastore upload feature to multiple users

Discovery Timeline

2026-07-30 - CVE-2026-18361 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18361

Vulnerability Analysis

The DFIR-IRIS application provides a shared datastore for uploading and organizing case artifacts during digital forensics and incident response work. The upload function accepts filenames and associated metadata from authenticated users and stores them for later retrieval. The application renders these values back to users through the web interface without applying context-appropriate output encoding.

Because the injected payload persists server-side, every user who navigates to the affected datastore view triggers execution. This turns a single upload into a durable foothold within the collaborative IR environment. Attackers can leverage the flaw to steal session tokens, perform actions on behalf of higher-privileged analysts, or pivot into linked case data.

Root Cause

The underlying defect is missing or insufficient neutralization of HTML and JavaScript metacharacters in datastore upload fields. User-controlled input flows into the rendered DOM as executable markup rather than inert text. Both server-side validation and client-side output encoding are absent for the affected sink.

Attack Vector

Exploitation requires an authenticated account with permission to upload to the datastore and relies on a second user opening the malicious entry. The attacker crafts a filename or metadata value containing a JavaScript payload, uploads it, and waits for another analyst to view it. Because IRIS is typically used by IR teams working shared cases, victim interaction is highly probable. Refer to the GitHub Security Advisory for the full technical writeup.

No verified proof-of-concept code is published in structured form; see the linked advisory for reproduction details.

Detection Methods for CVE-2026-18361

Indicators of Compromise

Datastore entries containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in filenames or descriptions
Unexpected outbound requests from analyst browsers to attacker-controlled domains shortly after opening a datastore item
Session token reuse from IP addresses that do not match the legitimate analyst workstation

Detection Strategies

Review IRIS audit logs for datastore upload events and inspect the stored filename and metadata fields for HTML or JavaScript syntax
Deploy a Content Security Policy (CSP) in report-only mode to surface script execution originating from datastore views
Correlate web proxy logs with IRIS session activity to identify anomalous script-driven requests

Monitoring Recommendations

Enable verbose access logging on the IRIS web tier and forward logs to a centralized analytics platform
Alert on datastore upload payloads that match XSS pattern signatures such as on\w+= event handlers or javascript: URIs
Monitor privileged IRIS accounts for actions initiated outside their normal working hours or workstations

How to Mitigate CVE-2026-18361

Immediate Actions Required

Restrict datastore upload permissions to a minimal set of trusted users until a fixed version is deployed
Audit existing datastore entries and remove any items containing HTML or scripting syntax in filenames or metadata
Rotate active IRIS session tokens and API keys if suspicious uploads are identified

Patch Information

No vendor patch reference is provided in the NVD entry at the time of publication. Administrators should track the GitHub Security Advisory and the DFIR-IRIS project release notes for a fixed build superseding version 2.4.26.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on the IRIS web interface
Place IRIS behind a web application firewall configured to block reflected and stored XSS payload patterns
Train IR analysts to treat unexpected datastore items with caution and to review uploads via safe rendering tooling before opening them in the IRIS UI

bash

# Example CSP header enforced via reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";