CVE-2024-34060

IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.

• CWE-22

• https://github.com/dfir-iris/iris-evtx-module/commit/4e45fc94a31e1ee4641d608a387dfd9f9e68dbca
• https://github.com/dfir-iris/iris-evtx-module/security/advisories/GHSA-9rw6-5q9j-82fm
• https://github.com/dfir-iris/iris-evtx-module/commit/4e45fc94a31e1ee4641d608a387dfd9f9e68dbca
• https://github.com/dfir-iris/iris-evtx-module/security/advisories/GHSA-9rw6-5q9j-82fm

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34050Open Networking Foundation SD-RAN Rimedo rimedo-ts 0.1.1 has…7.5
• CVE-2024-34051A Reflected Cross-site scripting (XSS) vulnerability located…4.6
• CVE-2024-34055Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows …6.5
• CVE-2024-34057Triangle Microworks TMW IEC 61850 Client source code librari…7.5
• CVE-2024-34058The WebTop package for NethServer 7 and 8 allows stored XSS …8.8
• CVE-2024-3406The WP Prayer WordPress plugin through 2.0.9 does not have C…8.8
• CVE-2024-34061changedetection.io is a free open source web page change det…4.3
• CVE-2024-34062tqdm is an open source progress bar for Python and CLI. Any …4.8
• CVE-2024-34063vodozemac is an implementation of Olm and Megolm in pure Rus…2.5
• CVE-2024-34064Jinja is an extensible templating engine. The `xmlattr` filt…5.4
• CVE-2024-34065Strapi is an open-source content management system. By combi…8.1
• CVE-2024-34066Pterodactyl wings is the server control plane for Pterodacty…8.4