Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-22783: Iris lets logged‑in users delete any file

CVE-2026-22783 · published 9 months ago

Summary

If you are using Iris version earlier than 2.4.24, any user who can log in can trick the system into deleting files anywhere on the server by changing the file name that is stored. This could cause loss of important data or disrupt the service. Upgrade Iris to version 2.4.24 or later to stop this behavior.

What to do

Update dfir-iris iris to version 2.4.24 or later.

Affected software

Vendor	Product	Affected versions
dfir-iris	iris	< 2.4.24 `cpe:2.3:a:dfir-iris:iris::::::::`

Original advisory text

Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24.

References

https://github.com/dfir-iris/iris-web/security/advisories/GHSA-qhqj-8qw6-wp8v Vendor Advisory
https://github.com/dfir-iris/iris-web/commit/57c1b80494bac187893aebc6d9df1ce6e56... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22783... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-22783 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-73External Control of File Name or Path

CWE-434Unrestricted File Upload

CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes

Timeline

Published12 Jan 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2026-22783 · NVD

CVE-2026-22783 · OSV

GHSA-qhqj-8qw6-wp8v · GHSA

Track software like this

Free during beta