MISP: 25 Vulnerabilities Disclosed in Batch, Affecting File Handling, Auth, and XSS
A batch of 25 vulnerabilities, including High severity flaws, were disclosed for the MISP threat intelligence platform on September 21-22, 2026.
Key findings
- 25 CVEs disclosed for MISP between Sep 21-22, 2026, ranging from Medium to High severity.
- Multiple vulnerabilities relate to insecure file handling and path manipulation, including CVE-2026-95806 and CVE-2026-94401.
- Access control and authorization flaws affect data integrity and user permissions, notably CVE-2026-94404 and CVE-2026-94381.
- Several stored and reflected XSS vulnerabilities were identified, such as CVE-2026-95682 and CVE-2026-95665.
- Installer scripts (CVE-2026-95667) and workflow modules (CVE-2026-94383) also present security risks.
On September 21-22, 2026, a batch of 25 vulnerabilities was disclosed for MISP, a threat intelligence platform. The vulnerabilities, ranging in severity from Medium to High, affect various components of the MISP system, including its core functionalities, controllers, and installer scripts. These disclosures highlight potential risks related to file handling, access control, cross-site scripting (XSS), and improper input validation.
Several vulnerabilities stem from insecure file handling and path manipulation. CVE-2026-95806, a High severity vulnerability, arises from MISP's use of PHP's phar stream wrapper, which can lead to unintended consequences when filesystem operations are performed on PHAR archives. Similarly, CVE-2026-95703, CVE-2026-95701, CVE-2026-95698, and CVE-2026-95693 involve improper validation of user-supplied file paths or temporary file names, potentially allowing for arbitrary file read or upload vulnerabilities when processing logos or uploaded pictures. CVE-2026-94401, another High severity issue, allows authenticated users to upload non-XML files, leading to the server reading files or accessing internal network services.
Access control and authorization flaws are also prevalent. CVE-2026-95697, a Medium severity vulnerability, allows users with a sharing group editor role to overwrite organization metadata without sufficient privilege verification. CVE-2026-95683 points out an authorization flaw in event enrichment, where report distribution and ACL constraints are not properly applied, potentially exposing sensitive information. CVE-2026-94404, a High severity vulnerability, enables attackers to alter threat intelligence data through a logged-in user's browser without explicit approval due to improper enforcement of protections against forged requests. Furthermore, CVE-2026-94394 and CVE-2026-94393 indicate issues where access controls are not consistently applied to individual data pieces or when moving reports between events, respectively. CVE-2026-94381, a High severity vulnerability, allows a read-only API key to potentially regain normal account permissions after login.
Cross-site scripting (XSS) vulnerabilities are present in multiple areas. CVE-2026-95682, a stored XSS vulnerability, occurs in the admin email composition screen due to unescaped organization name interpolation into a JavaScript string. Reflected XSS vulnerabilities include CVE-2026-95665 in the event REST search export confirmation form, CVE-2026-95661 in the attribute histogram view, and CVE-2026-95659 in the AnalystDataController::viewForObject action, all stemming from improper encoding or escaping of URL-supplied data.
Other notable vulnerabilities include CVE-2026-95805, a Medium severity access control misconfiguration in ACL rules; CVE-2026-95754, a Medium severity issue in TOTP verification where a database query missed a crucial column; CVE-2026-95685, an authorization flaw in EventReports functionality making an action accessible to any authenticated user; CVE-2026-95679, a logic error in XML request body decoding; CVE-2026-95674, a flaw in queryEnrichment where a missing module name leads to default parameter processing; CVE-2026-95671, where authorization checks in CollectionsController::add() were only enforced for POST requests, not PUT; CVE-2026-95667, a High severity issue in installer scripts creating a log file and named pipe that capture sensitive installation data; and CVE-2026-95658, where WorkflowsController exposed a sensitive action in the Security component's unlockedActions list, bypassing CSRF and field hash validation. CVE-2026-94383, a High severity vulnerability, involves the blocklist workflow module accepting user-supplied filenames without proper validation of the file extension.
The batch of vulnerabilities underscores the importance of rigorous input validation, secure file handling practices, and comprehensive access control mechanisms within the MISP platform. Users are advised to update their MISP instances to the patched versions as soon as possible to mitigate these risks.
The disclosures occurred between September 21 and September 22, 2026. The vulnerabilities span various components, including file upload handling, access control logic, XSS vulnerabilities, and installer script security. The High severity issues, such as CVE-2026-95806, CVE-2026-94404, CVE-2026-94401, CVE-2026-94383, and CVE-2026-94381, require immediate attention.
Users of MISP should prioritize applying security updates provided by the vendor. The diverse nature of these vulnerabilities suggests a need for a thorough review of security configurations and practices. Staying informed about future disclosures and updates from the MISP project is crucial for maintaining a secure threat intelligence environment.