CVE-2026-22783: 
NixOS vulnerability analysis and mitigation

CVE-2026-22783 is an arbitrary file deletion vulnerability in DFIR-IRIS (iris-web), a web collaborative platform used by incident responders. The flaw exists in the datastore file management system, where mass assignment of the file_local_name field combined with a lack of path validation in the delete operation allows authenticated users to delete arbitrary filesystem paths. All versions prior to 2.4.24 are affected; the issue was disclosed on January 12, 2026, and patched in version 2.4.24. It carries a CVSS v3.1 base score of 9.6 (Critical) per the GitHub Security Advisory, and 8.1 (High) per NVD (GitHub Advisory, Feedly).

The root cause is a combination of three weaknesses: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes / mass assignment), CWE-73 (External Control of File Name or Path), and CWE-434 (Unrestricted Upload of File with Dangerous Type). The application's datastore_update_file route previously passed the entire request form directly to the schema loader (dsf_schema.load(request.form, instance=dsf, partial=True)), allowing attackers to overwrite the file_local_name field — which stores the server-side filesystem path — with an arbitrary path. The datastore_delete_file function then trusted this database-stored path without re-validating that it resided within the designated datastore directory, directly calling fln.unlink() on whatever path was stored. The fix introduces an allowlist of permitted form fields and adds a path containment check (datastore_path in file_path.parents) before any file deletion (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to delete arbitrary files on the underlying filesystem with the privileges of the DFIR-IRIS application process, without any path restriction. This can result in deletion of critical system files, application configuration, evidence files, or other sensitive data, leading to data loss, system instability, and denial of service. Because DFIR-IRIS is used in active incident response workflows, destruction of case evidence or investigation data could have severe operational and legal consequences (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.06%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation requires only low-privilege authenticated access and no user interaction, making it accessible to any user with a valid account on the platform.

1. Authenticate: Obtain valid credentials for any user account on the DFIR-IRIS instance (low-privilege access is sufficient).
2. Upload a file: Use the DFIR-IRIS datastore API to upload a legitimate file to a case datastore, obtaining the resulting file record ID (e.g., POST /datastore/file/add/<case_id>).
3. Mass-assign the target path: Send a crafted PATCH or POST request to the file update endpoint (e.g., POST /datastore/file/update/<file_id>/<case_id>) with the form field file_local_name set to an arbitrary filesystem path (e.g., /etc/passwd, /app/config/production.ini, or any critical file accessible to the application process).
4. Trigger deletion: Call the delete endpoint for the same file record (e.g., POST /datastore/file/delete/<file_id>/<case_id>). The application reads the now-manipulated file_local_name from the database and calls unlink() on the attacker-controlled path without validation, deleting the target file.
5. Achieve objective: The target file is permanently deleted from the filesystem, potentially causing denial of service, destruction of evidence, or system instability (GitHub Advisory, Patch Commit).

• Logs: DFIR-IRIS application logs showing file_local_name values containing path traversal patterns (e.g., ../../, /etc/, /var/, /app/) in datastore file update requests; log entries from the patched version containing "File <path> physically not deleted - attempted deletion outside datastore directory."
• Network: Unusual API calls to datastore update endpoints (/datastore/file/update/) with form parameters including file_local_name pointing to paths outside the configured DATASTORE_PATH; followed shortly by calls to the corresponding delete endpoint.
• File System: Unexpected disappearance of system or application files (e.g., configuration files, log files, or OS files) that the DFIR-IRIS process has write access to; missing files in directories outside the DFIR-IRIS datastore directory.
• Database: Datastore file records in the database where file_local_name contains absolute paths outside the expected datastore directory (e.g., not matching the DATASTORE_PATH prefix) (GitHub Advisory, Patch Commit).

Upgrade DFIR-IRIS to version 2.4.24 or later, which introduces an allowlist of permitted form fields in the file update and add routes, and adds a path containment check in the delete operation to ensure only files within the configured DATASTORE_PATH can be deleted. No official workarounds are available for unpatched versions. As interim mitigations, restrict access to the DFIR-IRIS datastore functionality to trusted users only, apply filesystem-level access controls to limit the application process's ability to delete files outside the datastore directory, and monitor application logs for suspicious file_local_name values (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researchers zeroinfinitylab, 0xCZR1, whiteov3rflow, and mabitoski, and was published via GitHub's security advisory system (GitHub Advisory). The Hacker Wire covered the disclosure with a dedicated article, and the vulnerability was noted in CISA's weekly vulnerability bulletin for the week of January 12, 2026 (The Hacker Wire). Social media activity was observed on Bluesky and Mastodon/infosec.exchange shortly after disclosure, consistent with routine CVE announcement traffic.