CVE-2026-22783

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22783", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.388Z", "datePublished": "2026-01-12T18:27:38.259Z", "dateUpdated": "2026-01-12T18:52:04.765Z"}, "containers": {"cna": {"title": "Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-qhqj-8qw6-wp8v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-qhqj-8qw6-wp8v"}, {"name": "https://github.com/dfir-iris/iris-web/commit/57c1b80494bac187893aebc6d9df1ce6e56485b7", "tags": ["x_refsource_MISC"], "url": "https://github.com/dfir-iris/iris-web/commit/57c1b80494bac187893aebc6d9df1ce6e56485b7"}], "affected": [{"vendor": "dfir-iris", "product": "iris-web", "versions": [{"version": "< 2.4.24", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T18:27:38.259Z"}, "descriptions": [{"lang": "en", "value": "Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24."}], "source": {"advisory": "GHSA-qhqj-8qw6-wp8v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T18:51:44.715000Z", "id": "CVE-2026-22783", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:52:04.765Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22783", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T18:51:44.715000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:51:57.989Z"}}], "cna": {"title": "Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management", "source": {"advisory": "GHSA-qhqj-8qw6-wp8v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "dfir-iris", "product": "iris-web", "versions": [{"status": "affected", "version": "< 2.4.24"}]}], "references": [{"url": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-qhqj-8qw6-wp8v", "name": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-qhqj-8qw6-wp8v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dfir-iris/iris-web/commit/57c1b80494bac187893aebc6d9df1ce6e56485b7", "name": "https://github.com/dfir-iris/iris-web/commit/57c1b80494bac187893aebc6d9df1ce6e56485b7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T18:27:38.259Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22783", "state": "PUBLISHED", "dateUpdated": "2026-01-12T18:52:04.765Z", "dateReserved": "2026-01-09T18:27:19.388Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T18:27:38.259Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iris-web", "vendor": "dfir-iris", "versions": [{"status": "affected", "version": "< 2.4.24"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dfir-iris:iris:*:*:*:*:*:*:*:*", "matchCriteriaId": "310FB345-E2F3-475A-BC31-842B72778138", "versionEndExcluding": "2.4.24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24."}, {"lang": "es", "value": "Iris es una plataforma web colaborativa que ayuda a los respondedores de incidentes a compartir detalles t\u00e9cnicos durante las investigaciones. Antes de la versi\u00f3n 2.4.24, el sistema de gesti\u00f3n de archivos del almac\u00e9n de datos de DFIR-IRIS tiene una vulnerabilidad donde la asignaci\u00f3n masiva del campo file_local_name combinada con la confianza en la ruta en la operaci\u00f3n de eliminaci\u00f3n permite a los usuarios autenticados eliminar rutas arbitrarias del sistema de archivos. La vulnerabilidad se manifiesta a trav\u00e9s de una cadena de ataque de tres pasos: los usuarios autenticados suben un archivo al almac\u00e9n de datos, actualizan el campo file_local_name del archivo para que apunte a una ruta arbitraria del sistema de archivos mediante asignaci\u00f3n masiva, luego activan la operaci\u00f3n de eliminaci\u00f3n que elimina el archivo objetivo sin validaci\u00f3n de ruta. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.4.24."}], "id": "CVE-2026-22783", "lastModified": "2026-06-17T10:20:25.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22783", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T18:51:44.715000Z", "version": "2.0.3"}}]}, "published": "2026-01-12T19:16:03.953", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dfir-iris/iris-web/commit/57c1b80494bac187893aebc6d9df1ce6e56485b7"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/dfir-iris/iris-web/security/advisories/GHSA-qhqj-8qw6-wp8v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-434"}, {"lang": "en", "value": "CWE-915"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:28:15.167199+00:00", "value": {"mitigation_remediation": ["Apply the official Iris\u2011Web 2.4.24 patch or later that corrects the mass assignment bug and enforces path validation during deletion", "Enforce path validation by configuring OS file system controls (e.g., SELinux, AppArmor, chroot) to restrict delete operations to allowed directories", "Review and restrict user permissions, ensuring only authorized roles can modify the file_local_name field or invoke delete operations"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Deletion"}, "threat_synthesis": {"affected_systems": "DFIR-IRIS Iris\u2011Web versions prior to 2.4.24 are affected. The security advisory and update address the mass assignment issue in the file management subsystem. No specific sub\u2011components or third\u2011party libraries are listed beyond the main Iris\u2011Web application.", "description_and_impact": "The vulnerability in the DFIR-IRIS datastore file management system allows an authenticated user to delete any file on the server\u2019s filesystem. By mass\u2011assigning the file_local_name field to an arbitrary path during a file update operation, the system\u2019s delete routine performs the removal without performing path validation. This flaw can lead to denial of service for the affected application, loss of critical forensic artifacts, or the removal of system files if an attacker gains sufficient privileges. The weakness is rooted in improper input handling and insecure delete logic, corresponding to the identified CWEs for unsafe file deletion.", "risk_and_exploitability": "The CVSS score of 9.6 reflects a high\u2011severity impact; the EPSS score of < 1% indicates that exploitation is unlikely but not impossible. The vulnerability is not currently listed in CISA\u2019s KEV catalog, suggesting no confirmed widespread exploitation. Inferred from the description, the attack requires authenticated access to the application; the attacker must first upload a file, then update its filename to a target path, and finally invoke the delete operation. Once these conditions are satisfied, the system will delete the specified path without additional checks."}}}}, "created": "2026-01-13T09:27:18.304705+00:00", "updated": "2026-04-18T16:30:05.091373+00:00", "vendors": ["dfir-iris", "dfir-iris$PRODUCT$iris"]}