Read the docs
TI-2026-61818 Aliases CVE-2026-90957GHSA-5mp5-7f8h-r69q

MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Priority LOW 23CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693 and CWE-79.

Summary

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <img>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <script> elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session. The affected use cases include:  - organisation SVG logos;  - event-report SVG pictures. Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled. Version affected: ≤2.5.45

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Fixed MISP (MISP): 2.5.46

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MISPMISPbefore 2.5.462.5.46Patch availableCNA
  • MISP VendorMISP Affected before 2.5.46 Fixed in 2.5.46 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*——Misp-project
  • cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* Versions — — ·Misp-project

Remediation

  • Fix · CNA MISP (MISP) Fixed in 2.5.46

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MISP 2.5.46

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-61820 MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String CredentialsPriority MEDIUM 43
    • TI-2026-61767 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionPriority LOW 37
    • TI-2026-61765 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle EndpointsPriority LOW 23
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90957
  2. 2026-10-03 Alias added: GHSA-5mp5-7f8h-r69q

References

Patch 1

  • TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
  • TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
  • TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
  • TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
  • TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
  • TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
See all 182 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences