CVE-2026-90957 in MISP
Summary
by MITRE • 09/14/2026
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <img>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <script> elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.
The affected use cases include:
- organisation SVG logos; - event-report SVG pictures.
Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.
Version affected: ≤2.5.45
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability in versions of MISP up to and including 2.5.45 represents a critical failure in content type handling that leads to Cross-Site Scripting, specifically classified under CWE-79. This flaw stems from the application's decision to serve uploaded SVG images inline rather than as static attachments or within a restrictive browser sandbox context. While Scalable Vector Graphics are technically XML documents capable of containing executable code, they are often treated by developers and security teams similarly to passive bitmap formats like JPEGs or PNGs. However, unlike bitmaps, SVG files can contain script elements, event handlers, and javascript: URLs that execute within the context of the viewing page if not properly isolated.
The technical mechanism of this exploitation relies on how browsers interpret different embedding methods for media content. When an SVG is rendered via a standard img tag or displayed as a static image preview, most modern browsers restrict script execution to prevent immediate code injection. However, when the application serves the file inline—effectively treating it as HTML or XML that can be navigated to directly—the browser parses and executes any embedded scripts within the origin of the MISP instance. This means an attacker who uploads a malicious SVG containing JavaScript payloads can trigger those scripts with full privileges associated with the victim’s session, including access to cookies, local storage, and sensitive application data.
The operational impact is severe because it allows for persistent Cross-Site Scripting attacks against authenticated users of the MISP platform. The vulnerability affects specific use cases such as organization SVG logos and event-report SVG pictures. An attacker can upload a crafted SVG file that appears benign but contains hidden malicious code. When another user, particularly an administrator or analyst with elevated privileges, views this image through the web interface, the embedded script executes automatically. This enables session hijacking, credential theft, phishing attacks within the platform, and potentially full system compromise if combined with other vulnerabilities in the MISP application logic.
A critical aspect of this vulnerability is its persistence across configuration changes. The flaw exists on the serve path rather than just the upload validation layer. Consequently, even if an administrator disables SVG uploads after a malicious file has already been stored in the database or filesystem, the previously uploaded files remain dangerous. Any subsequent viewing of these legacy assets will still trigger the execution of embedded scripts because the server continues to serve them inline without sanitization or sandboxing. This creates a long-term risk that persists until all affected files are purged from storage and replaced with sanitized versions.
Mitigation strategies must address both immediate remediation and future prevention. The primary solution is to upgrade MISP to version 2.5.46 or later, where the serve path has been patched to enforce proper content security policies or MIME type restrictions that prevent inline execution of SVGs as executable documents. For environments unable to patch immediately, administrators should disable SVG support entirely if it is not strictly required for core functionality. Additionally, implementing a Content Security Policy with strict directives against script execution from user-uploaded directories can provide an additional layer of defense. It is also imperative to audit existing storage for any previously uploaded malicious SVGs and remove them or convert them to safe formats like PNG before they are served again.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution in the context of web browsers. It also reflects CWE-20 Improper Input Validation, as the application failed to validate or sanitize the content type and structure of uploaded files before serving them back to users. Security teams should monitor for unusual outbound network connections from MISP servers that may indicate successful exploitation attempts involving data exfiltration via script execution. Regular vulnerability assessments focusing on file upload mechanisms and MIME type handling are essential to prevent similar issues in other web applications within the infrastructure.