The vulnerability in the DFIR-IRIS datastore file management system allows an authenticated user to delete any file on the server’s filesystem. By mass‑assigning the file_local_name field to an arbitrary path during a file update operation, the system’s delete routine performs the removal without performing path validation. This flaw can lead to denial of service for the affected application, loss of critical forensic artifacts, or the removal of system files if an attacker gains sufficient privileges. The weakness is rooted in improper input handling and insecure delete logic, corresponding to the identified CWEs for unsafe file deletion.

DFIR-IRIS Iris‑Web versions prior to 2.4.24 are affected. The security advisory and update address the mass assignment issue in the file management subsystem. No specific sub‑components or third‑party libraries are listed beyond the main Iris‑Web application.

The CVSS score of 9.6 reflects a high‑severity impact; the EPSS score of < 1% indicates that exploitation is unlikely but not impossible. The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. Inferred from the description, the attack requires authenticated access to the application; the attacker must first upload a file, then update its filename to a target path, and finally invoke the delete operation. Once these conditions are satisfied, the system will delete the specified path without additional checks.