Loading story…
SBA Research publicly disclosed four vulnerabilities affecting DFIR-IRIS 2.4.26 and possibly other versions, including three stored cross-site scripting flaws—CVE-2026-16969, CVE-2026-18360, and CVE-2026-18361—and an insufficient logout implementation tracked as CVE-2026-16970. The stored XSS issues affect the assets, custom attributes, and datastore upload functions, allowing attacker-supplied JavaScript to run in a victim's browser. If an administrator is targeted, the impact could extend to session hijacking or broader application compromise. The XSS issues were assigned a CVSS 3.1 score of 7.6, while the logout flaw received a 4.2 rating.
The logout weakness leaves a stolen session cookie valid after a user signs out because the application removes the cookie only on the client side and does not invalidate the session server-side, enabling continued access to protected resources. At the time of disclosure, no fix was available, and SBA Research said repeated attempts to contact the vendor were unsuccessful before publishing the advisories. Recommended mitigations include stronger output encoding, safer templating practices, serving uploaded SVG files as attachments, tightening the Content Security Policy by removing unsafe-inline, and ensuring server-side session invalidation on logout.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
SBA Research publicly disclosed CVE-2026-16970, an insufficient logout implementation issue in DFIR-IRIS 2.4.26 and possibly other versions. The flaw leaves a stolen session cookie valid after logout because the server does not invalidate the session, and no fix was available at the time of publication.
SBA Research publicly disclosed three stored cross-site scripting flaws in DFIR-IRIS 2.4.26 and possibly other versions, tracked as CVE-2026-16969, CVE-2026-18360, and CVE-2026-18361. The advisory said no fix was available at disclosure time and that prior vendor contact attempts had gone unanswered.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcecheatsheetseries.owasp.org
Open sourcedocs.dfir-iris.org
Open sourceraw.githubusercontent.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SBA Research disclosed **CVE-2026-42540**, a medium-severity mass assignment vulnerability in **DFIR-IRIS** that affects versions up to and including `2.4.27`. The flaw allows authenticated users, including administrators, to manipulate API requests and change backend fields that are not meant to be editable through the GUI, exposing sensitive attributes such as asset type IDs, user UUIDs, usernames, account type, account active status, MFA secrets, and MFA activation state. The issue was traced to request data being loaded without strict field allowlisting across multiple endpoints, including asset type add/update functions and user update functionality. The advisory says some unauthorized changes are stopped only by database constraints rather than by application-layer validation, showing that the software still attempts prohibited updates. SBA Research said the bug was fixed in **DFIR-IRIS `2.4.28`** and urged users to upgrade, while also recommending strict allowlists or Data Transfer Objects to limit writable fields. The researchers added that the weakness appears systemic rather than isolated, noting an earlier related flaw, **CVE-2026-22783**, as evidence that mass assignment issues had not been comprehensively remediated across the codebase.
Jun 29, 2026
**Adobe Commerce** disclosed multiple **stored cross-site scripting (XSS)** vulnerabilities affecting versions `2.4.9-alpha3`, `2.4.8-p3`, `2.4.7-p8`, `2.4.6-p13`, `2.4.5-p15`, `2.4.4-p16`, and earlier. The issues tracked as `CVE-2026-21284`, `CVE-2026-21290`, `CVE-2026-21311`, and `CVE-2026-21361` allow malicious JavaScript to be injected into vulnerable form fields and later executed in a victim’s browser when the affected page is viewed. Adobe indicates the impact can include **session takeover** and high confidentiality and integrity risk. The vulnerabilities differ primarily in the privilege level required to plant the payload, with most requiring a **high-privileged attacker** and at least one (`CVE-2026-21290`) being exploitable by a **low-privileged attacker**. In all cases, exploitation requires **user interaction**, as a victim must browse to the page containing the injected content. A separate write-up about a chained exploit involving `postMessage` misconfiguration, prompt injection, and sandbox escape on an AI assistant platform does not describe the same Adobe Commerce disclosure and should be excluded.
Jun 29, 2026
Two newly disclosed web application flaws expose users to client-side data theft through content injection. In AVideo's **TopMenu** plugin, a stored cross-site scripting issue tracked as `GHSA-GMPC-FXG2-VCMQ` carries a CVSS 3.1 score of **6.1** and allows attackers to inject JavaScript that can read `document.cookie`, steal active session tokens, and impersonate users or administrators. Because the TopMenu component is rendered globally across the application, a malicious payload can execute for all site visitors, creating broad exposure and enabling follow-on attacks such as credential harvesting and fake login prompts. A separate issue in `rhukster/dom-sanitizer`, tracked as `GHSA-93VF-569F-22CQ`, allows **CSS injection** through SVG `style` tags and is rated **4.7** under CVSS 3.1. The flaw can be exploited remotely without authentication when a victim renders a crafted SVG in a browser, potentially disclosing the victim's IP address, browser details, exact page URL, and sensitive DOM-resident data such as CSRF tokens or partial session identifiers. While the sanitizer flaw does not directly alter server-side state or disrupt availability, both disclosures highlight how server-side handling of untrusted content can be turned into browser-based theft of session and application data.
Jun 29, 2026