CVE-2026-77751 in MISP
Summary
by MITRE • 08/21/2026
A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export.
MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template directory, the object name, and definition.json. An object name originating from untrusted STIX or MISP content was not sufficiently restricted before being used in this filesystem path.
An attacker able to supply a crafted object name containing path separators or traversal sequences such as ../ could therefore cause template resolution to escape the expected template directory and attempt to load a definition.json file from another location accessible to the process.
During STIX 2 import, an attacker-controlled x_misp_name from a custom STIX object could directly reach this template-resolution mechanism.
The issue could also become persistent. A malicious object name stored in a MISP event could later be processed again during STIX 2 export. Consequently, content originally introduced in one security context could trigger filesystem access later when the event is exported by a process operating with different or greater privileges.
If a suitable definition.json file exists outside the intended template directory, its contents may be interpreted as a MISP object template and fields from that file copied into the converted object. This can result in unintended disclosure of locally accessible data represented by the template file and modification of the resulting object's metadata or semantics.
The patches introduce strict validation of object-template names. Valid names are restricted to a single path component containing letters, digits, hyphens, or underscores. Names that do not meet these requirements are replaced with the generic unknown-template name before reaching PyMISP template resolution. The original rejected name is preserved in the object's comment and a warning is generated, preventing traversal while retaining the source information.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified involves a critical path traversal flaw within the MISP platform during STIX 2 import and export operations. This security issue stems from insufficient validation of user-supplied input when resolving object templates. Specifically, the system constructs filesystem paths by combining a configured directory with an object name provided via untrusted sources such as STIX objects or existing MISP content. The core technical flaw lies in the failure to sanitize these names before they are used in file system operations, allowing attackers to inject path traversal sequences like dot-dot-slash into the filename component. This lack of restriction enables the application to escape its intended directory boundaries and access arbitrary files on the underlying operating system that are readable by the process executing MISP.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The attack vector allows an adversary to manipulate the x_misp_name field within custom STIX objects during import or leverage stored malicious data in existing events during export. By supplying crafted object names containing path separators, an attacker can force the template resolution mechanism to load definition.json files from locations outside the designated template directory. This behavior violates the principle of least privilege and secure default configurations, as it permits reading sensitive local files that were not intended for exposure through this specific application interface.
The operational impact of this vulnerability extends beyond simple information disclosure. If a maliciously crafted or pre-existing file is accessed via path traversal, its contents are interpreted as MISP object templates. This leads to the extraction and injection of fields from external data into the converted STIX objects, potentially resulting in unintended modification of metadata or semantic meaning within the security intelligence feeds. Furthermore, this vulnerability exhibits persistence characteristics because maliciously stored event content can be re-processed during subsequent export operations. This creates a scenario where an attacker introduces harmful input in one context that triggers filesystem access later when different processes with varying privilege levels handle the data, thereby amplifying the potential for exploitation across multiple operational phases of the MISP workflow.
In terms of threat intelligence and attack frameworks, this vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to enumerate and access files within the server environment. It also relates to CWE-94: Improper Control of Generation of Code (Code Injection) in a broader sense if the loaded template data is executed or processed further by the application logic. The ability to read arbitrary files can serve as a stepping stone for more severe attacks, including remote code execution if combined with other vulnerabilities that allow exploitation of the parsed configuration data.
To mitigate this risk, developers have implemented strict validation rules for object-template names during both import and export processes. Valid names are now restricted to single path components consisting only of alphanumeric characters, hyphens, or underscores. Any input failing these criteria is rejected and replaced with a generic unknown-template identifier before reaching the resolution mechanism. This approach ensures that no traversal sequences can be processed while maintaining traceability by preserving the original invalid name in object comments and generating warnings. Organizations running affected versions should immediately apply this patch to prevent unauthorized file access and ensure the integrity of their STIX 2 data exchanges.