Threats Tagged 'cve-2026-77751'

A path traversal vulnerability in MISP's handling of object template names during STIX 2 import and MISP-to-STIX 2 export allows crafted object names containing path traversal sequences to escape the intended template directory. This can lead to loading and interpreting unintended definition.json files from other filesystem locations, potentially disclosing local data or altering object metadata. The vulnerability arises because object names from untrusted STIX or MISP content were not properly validated before being used in filesystem paths. Patches introduce strict validation restricting object-template names to safe characters and replace invalid names with a generic placeholder, preventing traversal while preserving source information in comments.

CVE-2026-77751 is a path traversal vulnerability in misp-stix affecting the handling of MISP object template names during STIX 2 import and export. The vulnerability allows crafted object names containing path traversal sequences to escape the intended template directory and load arbitrary definition.json files accessible to the process. This can lead to unintended disclosure of local data and modification of object metadata. The issue is mitigated by patches that enforce strict validation of object-template names, restricting them to safe characters and replacing invalid names with a generic placeholder.