CVE-2026-77751: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in misp misp-stix

The vulnerability arises from insufficient validation of MISP object template names used in PyMISP's object-template resolution mechanism. Specifically, object names from untrusted STIX or MISP content are concatenated into filesystem paths without adequate restriction, allowing path traversal sequences such as '../' to access files outside the intended directory. During STIX 2 import, attacker-controlled names can trigger this behavior, and the issue can persist through STIX 2 export, potentially causing filesystem access under different privilege contexts. If an attacker can cause loading of an unintended definition.json file, local data disclosure and alteration of object semantics may occur. The vendor has patched this by enforcing strict validation rules on template names, allowing only single path components with letters, digits, hyphens, or underscores, and replacing invalid names with a safe generic name while preserving the original in comments.

An attacker able to supply crafted object names can cause the system to load arbitrary definition.json files from locations outside the intended template directory. This may lead to disclosure of local files accessible to the process and modification of the metadata or semantics of MISP objects. The vulnerability can be triggered during STIX 2 import and may persist to STIX 2 export, potentially causing unintended filesystem access under different privilege contexts. The CVSS 4.0 score is 8.8 (high severity), indicating a significant impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Patches are available that introduce strict validation of object-template names, restricting them to safe characters and replacing invalid names with a generic placeholder before template resolution. Users should upgrade to versions later than 2026.7.8 where these fixes are applied. Since this is not a cloud service, remediation requires applying the official patch. No indication exists that no action is required or that the issue is already mitigated without patching. Check the vendor advisory for the latest patch details and apply updates promptly.