The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

CVE-2026-16969 describes a stored cross-site scripting (XSS) vulnerability in the IRIS web application, specifically in version 2.4.26 and possibly other versions. The vulnerability exists within the assets function of the application. Stored XSS vulnerabilities allow attackers to inject malicious scripts that are persistently saved on the server and executed in the browsers of users who access the affected page. IRIS is a DFIR (Digital Forensics and Incident Response) collaborative platform, making this vulnerability particularly sensitive as it targets security professionals. The vulnerability was reported by SBA Research and published as an advisory. Exploitation could lead to session hijacking, credential theft, or further compromise of the incident response environment.