CVE-2026-8080 in MISP
Summary
by MITRE • 05/07/2026
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.
This issue affects MISP before 2.5.37.
A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value.
This affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/23/2026
The vulnerability under discussion represents a critical stored cross-site scripting weakness in the MISP platform that has significant implications for web application security. This flaw exists within the template element attribute handling mechanism of MISP versions prior to 2.5.37, specifically targeting the legacy templating engine that was scheduled for removal in version 2.5.38. The vulnerability stems from inadequate input validation during web page generation processes, creating a pathway for malicious actors to inject persistent script code into the application's template elements.
The technical flaw manifests in the application's failure to properly sanitize and validate template element attribute values, particularly those related to the TemplateElementAttribute type and category fields. The system accepted arbitrary input without cross-referencing against established MISP attribute type and category definitions, effectively allowing attackers to inject malicious content through legitimate template modification interfaces. This improper neutralization of input during web page generation creates a persistent security risk where malicious scripts can be stored within the application's template system and executed whenever affected pages are rendered to unsuspecting users.
The operational impact of this vulnerability extends beyond simple script injection, as it enables attackers with sufficient permissions to compromise user sessions and potentially escalate privileges within the MISP environment. The stored nature of the XSS vulnerability means that malicious payloads persist in the application's database, making them particularly dangerous as they can affect multiple users over extended periods without requiring repeated exploitation attempts. This vulnerability directly aligns with CWE-79, which defines Cross-site Scripting as a common weakness in web applications where user-supplied data is not properly sanitized before being rendered in web pages. The attack surface is further expanded by the fact that the vulnerability affects the legacy templating engine, which was accessible to users with appropriate permissions to create or modify template elements.
The security implications of this vulnerability are particularly concerning given that MISP is widely used in cybersecurity operations for threat intelligence sharing and incident response activities. Attackers could leverage this weakness to steal session cookies, perform actions on behalf of authenticated users, or redirect victims to malicious domains that could further compromise their security posture. The vulnerability's persistence through the legacy templating engine makes it especially dangerous as it provides attackers with a stable mechanism to maintain access and execute malicious code across multiple user sessions. Organizations using MISP versions prior to 2.5.37 should immediately implement mitigations including updating to the patched version, implementing strict input validation for template elements, and monitoring for any unauthorized template modifications that could indicate exploitation attempts.
Mitigation strategies should focus on immediate version upgrades to MISP 2.5.37 or later, which contain the necessary fixes for this vulnerability. Additionally, organizations should implement comprehensive input validation and sanitization measures for all template element attributes, particularly those related to type and category fields. The ATT&CK framework categorizes this vulnerability under T1531 - Account Access Token Manipulation and T1203 - Exploitation for Client Execution, highlighting the potential for privilege escalation and persistent access through stored XSS attacks. Security teams should also consider implementing web application firewalls and content security policies to provide additional layers of protection against similar vulnerabilities in the future.