CVE-2026-94277 in MISP
Summary
by MITRE • 09/21/2026
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.
Version affected: <2.5.47
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified involves a stored cross-site scripting flaw within the Misinformation Sharing Platform, specifically affecting versions prior to 2.5.47. The root cause lies in the rendering logic of the galaxy matrix statistics view located at app/View/Users/statistics_galaxymatrix.ctp. This component is responsible for displaying statistical data regarding threat intelligence galaxies, which are collections of related indicators and attributes used by security analysts. The technical flaw stems from the use of the sprintf function to interpolate user-supplied input directly into HTML output without applying any form of encoding or sanitization. In a secure implementation, dynamic content derived from database entries must be escaped using context-aware methods such as htmlspecialchars with appropriate flags before being inserted into an HTML document structure. By failing to do so, the application treats raw string data containing markup characters as executable code rather than plain text.
The exploitation of this vulnerability requires specific conditions that define its severity and attack vector. An attacker must possess authenticated access to the MISP instance and hold the perm_galaxy_editor permission. This privilege level allows the user to create or modify galaxy definitions, including their display names. Once an adversary with these permissions crafts a galaxy name containing malicious HTML or JavaScript payloads, such as script tags designed to steal cookies or redirect users to phishing sites, this payload is stored in the backend database. The vulnerability manifests when any other authenticated user navigates to the galaxy matrix statistics page. Upon loading, the application retrieves the unescaped galaxy name and renders it immediately within the browser context of the viewing user. This constitutes a classic case of reflected data becoming persistent through storage, leading to execution upon subsequent visits by victims who have no direct interaction with the malicious input beyond viewing the affected view.
The operational impact of this vulnerability is significant due to its potential for widespread compromise within an organization or community using MISP. Since the payload executes in the context of any user visiting the statistics page, it facilitates session hijacking through the theft of authentication cookies and tokens stored by the browser. Attackers can leverage these credentials to impersonate legitimate users, gaining unauthorized access to sensitive threat intelligence data. Furthermore, the ability to execute arbitrary JavaScript enables data exfiltration, where internal indicators, malware samples, or organizational metadata are transmitted to external servers controlled by the attacker. The vulnerability also allows for the performance of actions on behalf of the victim, such as modifying settings, deleting galaxies, or exporting large datasets without consent. This undermines the integrity and confidentiality guarantees provided by the platform, potentially leading to reputational damage and loss of trust among community members who rely on accurate and secure information sharing.
From a classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored input that is later rendered without proper validation or encoding. In terms of the MITRE ATT&CK framework, this vulnerability supports techniques related to Collection via Browser-based Capture under Tactic Credential Access and Data Exfiltration over C2 Channel under Command and Control. Attackers can use the stolen session tokens to maintain persistent access while exfiltrating data through standard HTTP requests initiated by the victim's browser. The lack of output encoding represents a fundamental failure in input validation strategies, highlighting the necessity for strict adherence to secure coding practices that assume all user-controlled data is potentially malicious until proven otherwise.
Mitigation efforts should prioritize immediate upgrading to version 2.5.47 or later, where this issue has been addressed by implementing proper HTML entity encoding on galaxy names before they are rendered in the statistics view. For environments unable to upgrade immediately, administrative controls can be employed to restrict perm_galaxy_editor privileges to a minimal set of trusted administrators who do not routinely access the affected statistics page. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking script injection patterns may provide temporary relief by intercepting malicious payloads before they are stored or rendered. Long-term remediation requires integrating automated static analysis tools into the development pipeline to detect instances where user input is passed directly to output functions without sanitization. Security training for developers should emphasize the importance of context-aware encoding, ensuring that data intended for HTML bodies is encoded differently from data destined for JavaScript contexts or URL parameters. Regular penetration testing focusing on stored XSS vectors will help identify similar weaknesses in other modules before they can be exploited by adversaries seeking to compromise threat intelligence ecosystems.