Skip to content
OpenAdvisories
Medium WID-SEC-2026-3520 19 CVEs

MISP: Mehrere Schwachstellen

Published Sep 22, 2026 · Updated Sep 22, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 19

  • High 7.7
    CVE-2026-95806

    MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths

    MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.  The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:    - any filesystem operation on a c…

    MISP MISP
  • Medium 6.9
    CVE-2026-95658

    MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules

    MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because…

    MISP MISP
  • Medium 6.9
    CVE-2026-95667

    MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

    The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data …

    MISP MISP
  • Medium 6.9
    CVE-2026-95679

    MISP Unauthenticated Blind SSRF via XML Body Processing

    MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes the htt…

    MISP MISP
  • Medium 6.9
    CVE-2026-95754

    MISP: Disabled-user check ineffective in pre-authentication TOTP login branch

    In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.t…

    MISP MISP
  • Medium 5.3
    CVE-2026-95671

    MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

    In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT req…

    MISP MISP
  • Medium 5.3
    CVE-2026-95674

    MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation

    In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued proces…

    MISP MISP
  • Medium 5.3
    CVE-2026-95683

    MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL

    In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constrain…

    MISP MISP
  • Medium 5.3
    CVE-2026-95685

    MISP Missing Authorization on replaceSuggestionInReport Event Report Action

    MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, …

    MISP MISP
  • Medium 5.3
    CVE-2026-95693

    MISP Information Disclosure via Forged Upload Path

    In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_fil…

    MISP MISP
  • Medium 5.3
    CVE-2026-95697

    MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

    MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privilege…

    MISP MISP
  • Medium 5.3
    CVE-2026-95698

    MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name

    The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field…

    MISP MISP
  • Medium 5.3
    CVE-2026-95805

    MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

    A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. In the MISP ACL s…

    MISP MISP
  • Medium 5.1
    CVE-2026-95661

    MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attr…

    MISP MISP
  • Medium 5.1
    CVE-2026-95665

    MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted Ja…

    MISP MISP
  • Medium 5.1
    CVE-2026-95701

    MISP Path Traversal via Organization Name in Org-Statistics Logo Check

    In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called file_exists() with a path constructed as AP…

    MISP MISP
  • Medium 5.1
    CVE-2026-95703

    MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name

    In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploa…

    MISP MISP
  • Medium 4.8
    CVE-2026-95659

    MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread v…

    MISP MISP
  • Medium 4.8
    CVE-2026-95682

    MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

    MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "<?php echo $org;?>…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References