Skip to content
OpenAdvisories
Medium WID-SEC-2026-3314 2 CVEs

MISP: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Published Sep 10, 2026 · Updated Sep 10, 2026 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Dateien zu manipulieren.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 2

  • High 7.1
    CVE-2026-88915

    MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

    Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharing_group_id. The instantiation path passed that value into event cr…

    MISP MISP
  • Medium 5.1
    CVE-2026-88921

    MISP: Unescaped HTML Injection in PDF Report Element Rendering

    MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the convert_markdown_to_pdf m…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References