The IRIS web application, a DFIR (Digital Forensics and Incident Response) platform, version 2.4.26 and possibly other versions, contains a stored cross-site scripting (XSS) vulnerability in its datastore upload function. This vulnerability allows attackers to inject malicious scripts that are persistently stored and executed in the context of other users' browsers. Stored XSS vulnerabilities are particularly dangerous as they do not require social engineering to trigger once the payload is in place. The vulnerability was discovered and disclosed by SBA Research, as referenced in the GitHub advisory. This affects security teams and organizations relying on IRIS for incident response workflows. Exploitation could lead to session hijacking, credential theft, or further compromise of the DFIR platform itself. The CVE was assigned as CVE-2026-18361 and is tracked on the NVD.