CVE-2026-42538: IRIS File Upload & XSS Vulnerability – Patch to 2.4.28

Technical summary

CVE-2026-42538 stems from insufficient input validation on file uploads in IRIS prior to version 2.4.28. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw permits authenticated users to upload files that bypass content-type and extension checks, allowing arbitrary hosted content including HTML/JavaScript payloads. When other users access these uploads, the browser executes client-side code in the security context of the IRIS domain, enabling session hijacking, credential theft, or lateral reconnaissance within the incident response workflow.

Business impact

A compromised IRIS instance becomes a vector for internal phishing campaigns targeting incident responders—a high-value subset of security staff. Attackers with valid credentials (or who obtain them via the XSS) can inject malicious pages into shared incident investigations, potentially harvesting credentials or redirecting responders to credential-harvesting sites. This undermines the integrity of incident response investigations and could expose sensitive details discussed during collaborative analysis. For organizations using IRIS as a central hub for breach coordination, this vulnerability poses a reputational and operational risk.

Affected systems

IRIS versions prior to 2.4.28 are vulnerable. The vendors_products field is empty in the source data, so verification that IRIS is the sole affected product is recommended. Deployed instances of IRIS in any environment—on-premises or cloud-hosted—used for incident response coordination are at risk if running unpatched versions.

Exploitability

Exploitation requires valid IRIS credentials (PR:L in the CVSS vector), placing this threat primarily in the insider or compromised-account category. However, an attacker with read-level access can upload a malicious file and then socially engineer or trick a higher-privileged responder into opening it, triggering the XSS. The attack surface is limited by authentication, but internal threats or credential compromise make this practical. No CISA KEV entry currently exists for this CVE.

Remediation

Upgrade IRIS to version 2.4.28 or later, which contains the patch. Before patching, restrict file upload permissions to trusted personnel and monitor uploaded files for suspicious content. Implement Content-Security-Policy (CSP) headers to mitigate XSS impact across the platform. Review audit logs for unauthorized file uploads or XSS-like payloads in recent commits.

Patch guidance

Apply version 2.4.28 as the minimum remediation. Verify the patch release notes against the official IRIS repository or vendor advisory to confirm all file validation improvements are included. Coordinate patching during a maintenance window to avoid disrupting active incident response activities. Test in a staging environment first to ensure compatibility with existing workflows and plugins.

Detection guidance

Monitor IRIS file uploads for suspicious patterns: files with double extensions (e.g., .php.txt), executable content in text fields, or HTML/JavaScript payloads in non-media uploads. Query audit logs for uploads by low-privilege accounts followed by access from unexpected IP addresses or user agents. Enable SIEM integration to alert on XSS-like payloads in file metadata or content. Browser-side detection includes monitoring for unexpected redirects or credential prompts when opening IRIS attachments.

Why prioritize this

Although the CVSS score is 6.3 (Medium), the context elevates urgency: IRIS is used by incident responders during active investigations, making it a high-value target. An insider or compromised account can poison shared incident data, compromising the integrity of security investigations. The combination of XSS and hosting malicious content creates a compounding risk. Organizations managing active breaches should prioritize patching to prevent attackers from sabotaging investigation efforts.

Risk score, explained

CVSS 6.3 reflects the need for authentication (PR:L) and user interaction (UI:R) to trigger the XSS, limiting immediate impact. However, the High confidentiality impact (C:H) and the narrow, high-value user base of incident responders mean the actual organizational risk may exceed the numeric score. The Medium severity is appropriate for environments with robust access controls; however, environments with credential reuse or lax access governance should treat this as High priority.

Frequently asked questions