Vulnerabilities

MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the corre…

In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not include the User.disabled column in its SELECT fields list.

In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to…

In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image.

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resu…

MISP contains an authorization flaw in the Organisation model's captureOrg method.

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a…

MISP contains an access control flaw in the EventReports functionality.

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes.

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen.

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests.

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match.

In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST.

The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action.

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list.