MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process. The vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server's confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user. Version affected: <2.5.47
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MISP | MISP | before 2.5.47 | 2.5.47 | Patch available | CNA |
- MISP VendorMISP Affected before 2.5.47 Fixed in 2.5.47 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* | — | — | Misp-project |
- cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* Versions — — ·Misp-project
Remediation
- Fix · CNA MISP (MISP) Fixed in 2.5.47
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
MISP 2.5.47
11 records Highest priority Priority MEDIUM 2 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2026-63404 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimePriority MEDIUM 40
- TI-2026-63403 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)Priority LOW 37
- TI-2026-63419 MISP Arbitrary Local File Read and SSRF via MISP Export UploadPriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2026-94383
- 2026-10-03 Alias added: GHSA-8q25-97q9-g9wh
References
Patch 1
More MISP vulnerabilities
- TI-2025-41517 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. CVSS 3.1CRITICAL 9.0
- TI-2026-65744 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period CVSS 4.0CRITICAL 9.3
- TI-2026-54145 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library CVSS 4.0HIGH 8.8
- TI-2020-10250 MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. CVSS 3.1CRITICAL 9.8
- TI-2026-59159 MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding CVSS 4.0HIGH 8.7
- TI-2026-58541 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials CVSS 4.0CRITICAL 9.5
Sources
- CVE-2026-94383 · CVE Program
- CVE-2026-94383 · NVD
- FIRST EPSS
- GHSA-8q25-97q9-g9wh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences