Skip to content
OpenAdvisories
Medium · 6.8 Public exploit CVE-2026-8080 EUVD-2026-28357GHSA-3v62-pvrh-853r

MISP core - Stored XSS in MISP template (old engine) element attribute type

Published May 7, 2026 · Updated May 7, 2026 · Assigned by CIRCL

Vendor: MISP Product: MISP

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.

This issue affects MISP before 2.5.37.

A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value.

This affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38

Affected products

VendorProductAffectedFixed
misp misp < 2.5.37 2.5.37

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References