The vulnerability (CVE-2026-77751) involves insufficient validation of MISP object template names used in PyMISP's template resolution mechanism during STIX 2 import and export. An attacker can supply crafted object names containing path traversal sequences (e.g., '../') that cause the system to load definition.json files from outside the intended template directory. This can result in unintended disclosure of local files and modification of object metadata. The issue can persist because malicious names stored in MISP events may trigger filesystem access later during export, potentially under different privilege contexts. The fix enforces strict validation allowing only single path components with letters, digits, hyphens, or underscores, replacing invalid names with 'unknown-template' and logging warnings to prevent traversal attacks.

An attacker able to supply malicious object names can cause the system to read arbitrary definition.json files outside the expected template directory. This may lead to disclosure of local data accessible to the process and unintended modification of MISP object metadata or semantics. The vulnerability can persist in stored events and be triggered later during export, possibly under higher privileges, increasing the risk of data exposure or manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patches introduce strict validation of object-template names to prevent path traversal by restricting allowed characters and replacing invalid names with a safe placeholder. Until an official fix is confirmed, avoid importing or exporting untrusted STIX 2 content containing custom object names. Monitor vendor advisories for updates and apply official patches once available.