CVE-2026-86440 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget.
The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differently from PHP's URL parsing.
As a result, values such as javascript: URLs or backslash-based authority forms could reach the generated anchor's href and execute script or navigate to an attacker-controlled origin when another user interacted with the widget. The upstream commit describes the issue as:
“javascript: and backslash URLs reached the href (stored XSS)”.
The fix routes widget URLs through a shared DashboardURLValidator, rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins, and validates the URL both in the widget handler and renderer.
Version affected: ≤2.5.45
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
A critical security vulnerability exists within versions of MISP up to 2.5.45 concerning the insufficient validation of URLs utilized by dashboard widgets, specifically affecting the Button widget functionality. This flaw stems from a fundamental discrepancy in how URL schemes and authority components are parsed and validated between the server-side PHP environment and client-side web browsers. The vulnerability allows for stored cross-site scripting attacks where maliciously crafted URLs can bypass existing security checks due to differences in normalization logic. When users configure dashboard widgets, they provide URL values that are stored directly into the system configuration without rigorous sanitization against browser-specific parsing behaviors. This oversight creates a pathway for attackers to inject executable scripts or redirect victims to unauthorized origins by exploiting edge cases in URL interpretation that were not accounted for during the initial development of the validation logic.
The technical root cause lies in the previous rendering mechanism which deemed a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname using PHP's native parsing functions. However, browsers often normalize URLs differently than PHP does, particularly regarding scheme handling and authority delimiters. For instance, certain malformed absolute URIs containing backslashes instead of forward slashes in the authority section can be interpreted by modern web engines as valid protocols or relative paths depending on context, while PHP might parse them incorrectly during validation. Furthermore, schemes such as javascript: were not explicitly blocked if they did not trigger a hostname mismatch under strict parsing rules. This divergence between server-side validation and client-side execution environment allows dangerous payloads to slip through the filter and be embedded directly into the href attribute of anchor tags within the dashboard interface.
The operational impact of this vulnerability is severe, enabling stored cross-site scripting attacks that compromise user sessions and potentially allow for data exfiltration or unauthorized actions on behalf of affected users. An attacker who can influence widget configuration values can embed a javascript: URI scheme payload into the button link. When another user interacts with the dashboard by clicking the configured button, their browser executes the embedded script within the context of the MISP application domain. This grants the attacker access to sensitive information such as authentication cookies, session tokens, or internal data visible to that specific user role. Additionally, backslash-based authority forms can be used to navigate users away from the legitimate MISP instance to an attacker-controlled origin, facilitating phishing attacks or further exploitation of trust relationships within the security operations center environment.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it represents a case where input validation fails to account for browser-specific parsing anomalies, leading to code injection via stored data. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Initial Access and Credential Access through phishing or drive-by script execution within trusted web applications. The attack vector relies on social engineering or insider threat scenarios where an attacker gains write access to widget configurations but lacks direct shell access, leveraging the application's own rendering engine to execute malicious code in the victim's browser context.
To mitigate this vulnerability, it is imperative that organizations running affected versions of MISP upgrade immediately to version 2.5.46 or later. The upstream fix introduces a robust DashboardURLValidator component that enforces strict validation rules on all widget URLs before they are stored or rendered. This validator explicitly rejects dangerous schemes such as javascript:, data:, and vbscript: regardless of how they might be normalized by browsers. It also blocks raw backslashes in authority positions, control characters, and any absolute origins that do not match the configured MISP hostname. The validation is applied consistently both at the point of input via the widget handler and during output rendering to ensure defense-in-depth. Administrators should verify their deployment version and apply patches promptly to close this gap between server-side logic and client-side execution environments.