The IRIS Web application version 2.4.26 contains a stored cross‑site scripting flaw in the datastore upload function. When attackers are able to submit malicious payloads through that function, the payload is later rendered in the browsers of users who view the stored data, allowing the attacker to execute arbitrary JavaScript and potentially hijack sessions or perform other client‑side attacks. The weakness is aligned with CWE‑79, which denotes inadequate sanitization of user‑generated content.

The vulnerability affects dfir‑iris’s IRIS Web application, particularly version 2.4.26 and potentially other releases around that number. No other vendors or product versions are currently substantiated.

The CVSS score of 7.6 indicates that the flaw is high‑severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The incident is not listed in the CISA KEV catalog. The likely attack vector involves an attacker using the datastore upload interface to insert malicious script payloads; this inference is not explicitly detailed in the CVE description but follows from the nature of stored XSS. Once the payload is stored, any user who later views the affected data will have the script executed in their browser, leading to client‑side compromise.