The IRIS web application version 2.4.26 contains a stored cross‑site scripting flaw in the custom attributes feature. A script entered into a custom attribute is persisted and later rendered in the browsers of any user who views that attribute, allowing execution of arbitrary JavaScript in the victim’s browser session.

The vulnerability affects the DFIR Iris Web application. The documented affected release is 2.4.26; the issue may also exist in earlier or unpatched releases. The custom attribute functionality is the component that is vulnerable.

The CVSS score of 7.6 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves submitting malicious code through the web interface’s custom attribute input, which is then served unchanged to other users’ browsers. Without mitigation, the flaw could enable arbitrary script execution in the context of the victim’s session.