Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:HSummary
CVE-2026-22783 is a critical-severity External Control of File Name or Path (CWE-73) vulnerability in Dfir-Iris Iris. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22783 affects the DFIR-IRIS datastore file management system in Iris, a web collaborative platform used by incident responders to share technical details during investigations. Prior to version 2.4.24, the vulnerability stems from mass assignment of the file_local_name field combined with insufficient path validation in the delete operation, linked to CWEs-73 (External Control of File Name or Path), CWE-434 (Unrestricted Upload of File with Dangerous Type), and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). This flaw enables authenticated users to manipulate file metadata and target arbitrary filesystem paths for deletion. The issue carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H), highlighting its critical severity due to high integrity and availability impacts in a changed scope.
An attacker with authenticated access (low privileges required) can exploit this through a three-step chain: first, upload a file to the datastore; second, use mass assignment to update the file's file_local_name field to an arbitrary filesystem path; third, trigger the delete operation, which trusts the modified path and removes the targeted file without validation. Successful exploitation allows arbitrary file deletion on the server, potentially disrupting Iris operations, erasing critical incident response data, or affecting underlying system files, with network-based access and no user interaction needed.
The vulnerability is addressed in Iris version 2.4.24, as detailed in the project's GitHub security advisory (GHSA-qhqj-8qw6-wp8v) and the fixing commit (57c1b80494bac187893aebc6d9df1ce6e56485b7). Security practitioners should upgrade to 2.4.24 or later to mitigate the issue, reviewing access controls for authenticated users in DFIR environments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2004
Vulnerability Data
Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in the…
more
delete operation enables authenticated users to delete arbitrary filesystem paths. The vulnerability manifests through a three-step attack chain: authenticated users upload a file to the datastore, update the file's file_local_name field to point to an arbitrary filesystem path through mass assignment, then trigger the delete operation which removes the target file without path validation. This vulnerability is fixed in 2.4.24.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.1.1V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorizations so that only permitted attributes may be modified on an object.
Limits the set of modifiable attributes a subject is authorized to touch.
Input validation directly rejects or sanitizes untrusted path strings before they reach filesystem operations.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least functionality restricts the file types and automatic processing capabilities the system will accept.
Mobile-code controls define, authorize, and block unacceptable uploaded code before automatic processing occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices include input validation and path sanitization that eliminate this weakness.
Least-privilege file authorization directly limits damage from externally controlled paths.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Hardened configuration baselines can enforce allowed file types and processing rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly forbid unsafe dynamic attribute assignment and require property allow-lists.
Security testing can detect path-traversal issues but does not itself implement preventive controls.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent external file/path manipulation.
Application security requirements explicitly call for controls against untrusted input influencing file operations.
Secure architecture principles discourage unsafe path construction but do not prescribe concrete file-name controls.
Information access restriction limits which files can be reached, indirectly reducing impact of path manipulation.