CVE-2026-95693 in MISP
Summary
by MITRE • 09/22/2026
In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.
This constitutes an information disclosure vulnerability: the server's filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.
The vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The identified vulnerability in MISP represents a classic path traversal and information disclosure flaw rooted in an insecure validation sequence within the EventReport::uploadPicture method. The core technical failure lies in the order of operations performed by the application when processing user-supplied input for the tmp_name field. Instead of first verifying that the provided file was uploaded via standard PHP mechanisms using is_uploaded_file(), the system proceeds to execute a series of filesystem probes including file_exists, mime_content_type, and exif_imagetype on the supplied path. This inversion of validation logic allows an authenticated user with the perm_add permission to bypass security controls by supplying arbitrary absolute or relative paths rather than legitimate uploaded files. Because these functions return distinct error codes or messages depending on whether a file exists at the specified location, its MIME type, and its image format characteristics, they effectively serve as side-channel indicators for remote attackers.
This behavior creates a reliable mechanism for filesystem enumeration, allowing an attacker to probe specific paths on the underlying server operating system. By systematically varying the input path and observing the resulting HTTP responses or error messages, an adversary can determine with high precision whether files exist at those locations and identify their types based on the specific validation failure returned by mime_content_type or exex_imagetype. This capability transforms a simple upload feature into a powerful reconnaissance tool that reveals the internal directory structure of the MISP instance. The vulnerability does not permit direct reading, writing, or execution of code through this vector alone; however, it significantly lowers the barrier for subsequent exploitation phases by mapping out sensitive areas of the filesystem such as configuration directories, backup files, and potentially private cryptographic keys stored on the host machine.
From a classification perspective, this flaw aligns with CWE-209 which describes the generation of an error message that includes stack traces or other diagnostic information revealing system paths to attackers. It also falls under CWE-538 regarding file and directory information leakage through error messages. In terms of offensive security frameworks, this vulnerability is indicative of ATT&CK technique T1083 File and Directory Discovery, where adversaries probe the local filesystem for sensitive data that can be used in further attacks. The lack of proper input validation before performing system-level operations allows low-privileged users to gain insights into the server environment that should remain confidential, violating the principle of least privilege by exposing infrastructure details without requiring administrative rights.
The operational impact of this vulnerability is primarily centered on intelligence gathering and pre-exploitation reconnaissance. While an attacker cannot directly exfiltrate file contents or execute commands through this specific endpoint, the ability to enumerate files can lead to more severe consequences if combined with other vulnerabilities. For instance, discovering the location of configuration files might reveal database credentials or API keys that could be exploited in a separate attack vector. Similarly, identifying private key locations could facilitate cryptographic attacks if those keys are weakly protected elsewhere on the system. The exposure of internal file paths also aids attackers in crafting more targeted payloads for other known vulnerabilities within the MISP application stack by confirming the presence and versioning of specific libraries or components based on their typical installation directories.
Mitigation strategies must address both the immediate code flaw and broader input validation practices. The primary fix involves reordering the validation logic so that is_uploaded_file is called before any filesystem operations such as file_exists, mime_content_type, or exif_imagetype are executed. This ensures that only files genuinely uploaded through PHP's temporary upload mechanism are processed, preventing arbitrary path traversal attempts from reaching system-level functions. Additionally, implementing strict allowlists for permitted file extensions and MIME types can further restrict the scope of acceptable inputs. It is also advisable to sanitize all user-supplied paths by resolving them against a predefined base directory and ensuring they remain within that boundary before any processing occurs. Regular security audits focusing on input validation sequences in upload handlers are essential to prevent similar logic errors from being introduced in other parts of the application.