The IRIS web application, particularly its assets feature, has a stored cross‑site scripting vulnerability. Attackers can store malicious script that is executed in the browsers of any user who views the compromised asset. This permits arbitrary client‑side code execution, potentially exposing user data, hijacking sessions, and delivering phishing payloads. The weakness is captured by CWE‑79.

DFIR‑IRIS’s iris‑web product is affected, with the known vulnerable release being version 2.4.26 and possibly preceding or succeeding builds that have not applied the fix. Systems running this version should be evaluated, and any deployment of older or unspecified releases should be considered at risk unless confirmed patched.

The CVSS score of 7.6 classifies the flaw as high severity, but the EPSS figure of less than 1 % indicates a very low probability of exploitation at the time of this assessment. The vulnerability was not featured in CISA’s KEV catalog. Attackers would most likely need the ability to create or edit an asset, implying authenticated access or a trust issue, to inject the malicious payload. Once the asset is rendered, all downstream users’ browsers become vulnerable.