CVE-2026-95698 in MISP
Summary
by MITRE • 09/22/2026
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory.
This yields two security impacts:
- an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access. - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.
The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The MISP platform contains a critical path traversal vulnerability within its OrgImgHelper component, specifically in the findOrgImage method responsible for rendering organizational logos and images. This flaw arises from improper validation of user-supplied input during the construction of filesystem paths. The application accepts an organization identifier or name through event import mechanisms, which directly populates the Org.name field without sufficient sanitization. When this value is concatenated with a fixed base directory path and a file extension to determine the location of an image asset, the lack of validation allows attackers to inject directory traversal sequences such as ../../etc/passwd into the organization name string. Consequently, the resulting filesystem path resolves outside the intended secure directory structure, enabling access to arbitrary files on the underlying operating system that are readable by the web server process user.
This vulnerability manifests primarily through two distinct security impacts: an arbitrary file existence oracle and a limited form of remote code execution via information disclosure. The first impact leverages the file_exists() function call within the application logic. Because this function returns a boolean value indicating whether a specified path exists, attackers can perform blind directory traversal attacks to probe for sensitive files such as configuration files containing database credentials or private keys. By observing response times or error states associated with existence checks, an attacker can map out the filesystem structure and identify valuable targets even if direct file content retrieval is restricted by extension filters. The second impact involves actual data exfiltration where the application serves the contents of resolved paths to the requesting user. Although this capability is constrained by the requirement that target files must have .png or .svg extensions, attackers can still exploit this vector to read sensitive configuration files if they are named with these extensions or through other creative file naming strategies supported by the operating system and web server configurations.
The operational impact of this vulnerability extends beyond simple data leakage. It compromises the integrity and confidentiality of the entire MISP instance by exposing internal infrastructure details, authentication secrets, and potentially source code that could facilitate further exploitation. Since the attack requires an authenticated user with privileges to create or import events, it represents a significant threat within multi-tenant environments where trust boundaries between organizations are critical. An attacker leveraging this flaw can escalate their privilege level from a standard user to one capable of extracting sensitive system information, potentially leading to full compromise if combined with other vulnerabilities such as server-side request forgery or insecure deserialization flaws that might be present in the same environment.
Mitigation strategies must focus on strict input validation and secure path handling practices. Developers should implement allowlist-based validation for organization names, ensuring they contain only alphanumeric characters and safe punctuation while explicitly rejecting directory traversal sequences like dots and slashes. Additionally, using canonicalization functions to resolve paths before comparison or access can help detect attempts to escape the intended directory structure regardless of encoding tricks used by attackers. Implementing chroot jails or containerized environments with restricted filesystem permissions further limits the blast radius should a bypass occur. From an architectural perspective, separating static asset serving from dynamic application logic reduces exposure surfaces. Security teams should also enforce principle of least privilege for web server processes to minimize access rights to sensitive system files such as /etc/passwd or configuration directories containing credentials.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause the path to resolve outside of intended directories. It also maps to MITRE ATT&CK technique T1083: File and Directory Discovery, as attackers use this flaw to enumerate system resources for subsequent exploitation phases. Regular security assessments focusing on input validation in dynamic web applications are essential to prevent such issues. Patching involves updating the MISP software to versions that include fixes for path traversal vulnerabilities in helper classes handling user-controlled inputs. Administrators should verify their deployments against known vulnerable versions and apply updates promptly while monitoring logs for signs of exploitation attempts involving unusual file access patterns or directory traversal strings in request parameters.