CVE-2026-94383 in MISP
Summary
by MITRE • 09/21/2026
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.
The vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server's confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.
Version affected: <2.5.47
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in versions of MISP prior to 2.5.47 represents a critical insecure file handling flaw within the blocklist workflow module, specifically classified under CWE-434 as an Unrestricted Upload of File with Dangerous Type. The core technical deficiency lies in the insufficient validation of user-supplied input for the blocklist filename parameter. While the application employs basename() to strip directory traversal characters and performs basic checks against empty or dot-only values, it completely fails to validate the file extension itself. This oversight allows an authenticated attacker who holds site-administrator privileges to specify a filename with any arbitrary extension, including executable script formats such as PHP, Python, or Perl scripts. The application proceeds to write this user-controlled content directly into the MISP export directory without verifying that the resulting file is safe for execution by the underlying web server infrastructure.
The operational impact of this vulnerability is severe, leading to Remote Code Execution (RCE) with the privileges of the web server process. If the hosting environment is configured to interpret and execute scripts from the export directory—a common configuration in many LAMP or similar stacks—the uploaded malicious file can be invoked via a simple HTTP request. This results in a full compromise of the MISP server's confidentiality, integrity, and availability. The attacker gains the ability to exfiltrate sensitive threat intelligence data stored within the platform, modify existing indicators to manipulate security operations, or deploy additional malware for persistent access. Although the requirement for site-administrator privileges limits the attack surface compared to unauthenticated vulnerabilities, it remains a critical risk as insider threats or compromised administrative credentials can easily exploit this flaw without requiring any further user interaction beyond triggering the specific workflow action with a crafted filename parameter.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1505.003, which covers Server Side Request Forgery components involving Web Shell installation, and potentially T1190 for Exploitation of Public-Facing Application if the administrative interface is exposed to untrusted networks. The lack of strict allow-listing for file extensions constitutes a fundamental failure in input validation principles. To mitigate this risk, organizations must upgrade immediately to MISP version 2.5.47 or later where these checks have been hardened. In environments where upgrading is not immediately feasible, administrators should ensure that the export directory is configured with execute permissions disabled at the web server level, preventing script interpretation even if malicious files are uploaded. Additionally, implementing strict file extension allow-lists within the application logic and enforcing principle of least privilege for administrative accounts can significantly reduce the likelihood of exploitation.