Skip to content
OpenAdvisories
Low WID-SEC-2026-3451 3 CVEs

MISP: Mehrere Schwachstellen

Published Sep 17, 2026 · Updated Sep 17, 2026 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen, Daten offenzulegen und zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 3

  • High 8.7
    CVE-2026-93295

    MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

    MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans t…

    MISP MISP
  • High 8.5
    CVE-2026-93296

    MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

    MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into…

    MISP MISP
  • Medium 5.1
    CVE-2026-92932

    MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

    In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http…

    MISP sachertortephp

Revision history

  1. #1

    Initiale Fassung

References