CVE-2026-95701 in MISP
Summary
by MITRE • 09/22/2026
In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called file_exists() with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs' . DS . $k . '.png', where $k is the organization name. Because the referenced directory (app/webroot/img/orgs) no longer exists in current MISP deployments (org logos were relocated to files/img/orgs), the check was functionally dead and never triggered. However, the underlying pattern—concatenating an attacker-influenced organization name into a file path without sanitization—constitutes a path traversal weakness. An organization name containing directory traversal sequences (e.g., '../../../../etc/passwd') would, if the target directory existed, allow an authenticated user with the ability to create or rename an organization to probe for the existence of arbitrary files on the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in MISP involves a path traversal weakness within the __statisticsOrgs method located in UsersController.php. This flaw stems from the insecure handling of user-supplied input, specifically the organization name provided by an authenticated user with privileges to create or rename organizations. The application constructs a file system path by concatenating this unsanitized organization name directly into a base directory structure intended for storing organizational logo images. Although the specific code path was functionally inert in recent deployments due to a relocation of asset directories, the underlying architectural pattern remains vulnerable. If an attacker were able to manipulate the input to include directory traversal sequences such as ../../../../etc/passwd, and if the target directory existed or could be made accessible through other means, it would allow for arbitrary file existence checks on the server's file system.
From a technical perspective, this issue represents a classic case of improper neutralization of special elements used in an OS command, commonly categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core failure lies in the lack of input validation and sanitization before the organization name is incorporated into the file path string. By relying on raw concatenation without stripping or validating directory traversal characters like dots and slashes, the application fails to enforce strict boundaries around the intended web root directory. This allows an attacker to break out of the restricted context and probe for files located in sensitive system directories outside the scope of the application's public-facing assets.
The operational impact of this vulnerability is primarily related to information disclosure through file existence probing. While it does not directly allow remote code execution or arbitrary file read, it enables a form of directory traversal reconnaissance. An authenticated attacker could systematically test various paths to determine which files exist on the server. This capability can be leveraged as part of a broader attack chain to map out the server's file structure, identify backup files, configuration files with sensitive data, or other critical system components that might reveal further vulnerabilities. The severity is contingent upon the level of access required; since authentication and specific privileges are needed, it is classified as an authenticated vulnerability rather than a remote unauthenticated exploit.
This behavior aligns with several entries in the MITRE ATT&CK framework, particularly those related to Discovery techniques where adversaries probe systems for information that can aid in further exploitation. Specifically, this falls under T1083: File and Directory Discovery, where attackers look for files or directories on a compromised system. The use of directory traversal sequences is also indicative of patterns seen in CWE-20: Improper Input Validation, as the application fails to adequately validate that the input consists only of expected characters suitable for a filename within the designated folder structure.
To mitigate this vulnerability, developers must implement strict input validation and sanitization practices. The organization name should be validated against a whitelist of allowed characters before being used in any file system operations. Additionally, using canonical path resolution functions provided by the programming language can help ensure that the final resolved path remains within the intended directory boundary regardless of traversal sequences included in the input. It is also recommended to refactor the code to use safe APIs for checking file existence that do not rely on direct string concatenation with user-controlled data. Regular security audits and static analysis tools should be employed to detect similar patterns across the codebase, ensuring that all dynamic path constructions are properly secured against traversal attacks.