Stored Cross-Site Scripting Vulnerability in IRIS Web Application by SBA Research
CVE-2026-16969

7.6HIGH

Key Information:

Vendor

Dfir-iris

Status
Iris-web
Vendor
CVE Published:
30 July 2026

What is CVE-2026-16969?

The IRIS web application, specifically version 2.4.26 and potentially others, is exposed to a stored cross-site scripting vulnerability within its assets function. This flaw could allow attackers to inject malicious scripts into webpages viewed by users, potentially compromising user data and site integrity.

Affected Version(s)

iris-web 2.4.26

References

https://github.com/sbaresearch/advisories/tree/public/202...
third-party-advisory

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Koppmann (SBA Research)
Mathias Tausig (SBA Research)
.