High severity8.8OSV Advisory· Published Dec 6, 2018· Updated Jun 22, 2026
CVE-2018-19908
CVE-2018-19908
Description
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
3- github.com/MISP/MISP/commit/211ac0737281b65e7da160f0aac52f401a94e1a3nvdPatchThird Party Advisory
- www.exploit-db.com/exploits/46401/nvdExploitThird Party AdvisoryVDB Entry
- github.com/MISP/MISP/releases/tag/v2.4.99nvdRelease NotesThird Party Advisory
News mentions
0No linked articles in our index yet.