Threats affecting pkg:github/MISP

A vulnerability in affected versions of MISP (up to 2.5.45) allows any authenticated user to access the TemplatesController::uploadFile() function due to a wildcard ACL entry. This bypasses intended role restrictions, enabling low-privileged or read-only users to upload arbitrary files repeatedly, consuming server disk space. The uploaded files receive random names, are stored outside the web root, and are not served over HTTP, preventing arbitrary file overwrite, stored XSS, or remote code execution.

MISP versions up to 2.5.45 have a vulnerability in the validation of the user-configurable homepage setting. The validation only checks if the path begins with a slash (/), which is insufficient because protocol-relative URLs starting with // can bypass this check and redirect users to external origins. This unsafe homepage value can be stored and later used in post-login routing, potentially leading to unsafe redirects. The vulnerability is identified as CVE-2026-86351 and is categorized as a moderate severity issue.

MISP versions up to 2.5.45 have improper authorization checks in the freetext feed preview functionality. This flaw allows users to access correlated event attributes and feed metadata without proper access control, exposing restricted event information and feed URLs. The vulnerability arises because correlation queries do not enforce user ACLs or feed visibility restrictions correctly. Fixes address these issues by applying ACLs consistently, removing feed URLs from results, and restricting cross-feed data to visible feeds only.

Multiple vulnerabilities have been identified in the open-source MISP platform for threat information sharing. These issues affect versions prior to 2.5.40. A fix is available in version 2.5.40. There are no known exploits in the wild, and no CVSS score is provided for these vulnerabilities.

CVE-2025-66386 is a path traversal vulnerability in the MISP platform prior to version 2.5.27, specifically in the app/Model/EventReport.php component. This flaw allows a site-admin user to manipulate file paths when viewing pictures, potentially accessing unauthorized files on the server. Although exploitation requires site-admin privileges, successful attacks could lead to unauthorized disclosure of sensitive files, impacting confidentiality. There are no known exploits in the wild yet, and no CVSS score has been assigned. The vulnerability affects MISP instances running versions before 2.5.27.

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.

app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.