This vulnerability involves improper limitation of pathname to a restricted directory (CWE-22) in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export in misp-stix. The PyMISP object-template resolution mechanism constructs filesystem paths by joining the configured template directory, the object name, and definition.json. Object names from untrusted STIX or MISP content were not sufficiently validated, allowing attackers to supply crafted names containing path traversal sequences (e.g., ../) to escape the intended directory. This can cause loading of unintended definition.json files, leading to disclosure of local files or modification of object metadata. The issue can persist because malicious object names stored in MISP events may trigger filesystem access later during export by processes with different privileges. The described patch enforces strict validation restricting names to a single path component with letters, digits, hyphens, or underscores, replacing invalid names with a generic unknown-template and preserving the original name in comments with warnings. However, no official remediation level or patch link is provided in the data.

An attacker able to supply crafted object names during STIX 2 import or MISP-to-STIX 2 export can cause the system to load arbitrary definition.json files outside the intended template directory. This may lead to unintended disclosure of local data accessible to the process and modification of MISP object metadata or semantics. The vulnerability can be exploited without privileges or user interaction, and the impact on confidentiality is high, with limited impact on integrity and no impact on availability. The issue can persist across import/export cycles, potentially escalating risk if processed by higher-privileged processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves strict validation of object-template names to restrict them to safe characters and a single path component, replacing invalid names with a generic placeholder and preserving original names in comments with warnings. Until an official patch is confirmed, users should avoid processing untrusted STIX or MISP content that could contain malicious object names. Monitor vendor advisories for updates and apply official patches when available.