Threat Intelligence Database

A vulnerability in affected versions of MISP (up to 2.5.45) allows any authenticated user to access the TemplatesController::uploadFile() function due to a wildcard ACL entry. This bypasses intended role restrictions, enabling low-privileged or read-only users to upload arbitrary files repeatedly, consuming server disk space. The uploaded files receive random names, are stored outside the web root, and are not served over HTTP, preventing arbitrary file overwrite, stored XSS, or remote code execution.

MISP versions up to 2.5.45 have a vulnerability in the validation of the user-configurable homepage setting. The validation only checks if the path begins with a slash (/), which is insufficient because protocol-relative URLs starting with // can bypass this check and redirect users to external origins. This unsafe homepage value can be stored and later used in post-login routing, potentially leading to unsafe redirects. The vulnerability is identified as CVE-2026-86351 and is categorized as a moderate severity issue.

MISP versions up to 2.5.45 have improper authorization checks in the freetext feed preview functionality. This flaw allows users to access correlated event attributes and feed metadata without proper access control, exposing restricted event information and feed URLs. The vulnerability arises because correlation queries do not enforce user ACLs or feed visibility restrictions correctly. Fixes address these issues by applying ACLs consistently, removing feed URLs from results, and restricting cross-feed data to visible feeds only.

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

CVE-2025-66386 is a path traversal vulnerability in the MISP platform prior to version 2.5.27, specifically in the app/Model/EventReport.php component. This flaw allows a site-admin user to manipulate file paths when viewing pictures, potentially accessing unauthorized files on the server. Although exploitation requires site-admin privileges, successful attacks could lead to unauthorized disclosure of sensitive files, impacting confidentiality. There are no known exploits in the wild yet, and no CVSS score has been assigned. The vulnerability affects MISP instances running versions before 2.5.27.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-66386

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.

MediumVulnerabilityUnited StatesGermanyFrance+7#cve#cve-2024-54675

app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.

MediumVulnerabilityUnited StatesGermanyFrance+7#cve#cve-2024-54674

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.

CriticalVulnerabilityUnited StatesGermanyFrance+7#cve#cve-2024-45509

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.

CriticalVulnerabilityUnited StatesGermanyFrance+7#cve#cve-2024-29859

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.

CriticalVulnerabilityUnited StatesGermanyFrance+7#cve#cve-2024-29858