CVE-2026-95703 in MISP
Summary
by MITRE • 09/22/2026
In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.
The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability in MISP’s OrganisationsController::__uploadLogo method represents a classic timing-based information leakage flaw rooted in improper input validation sequencing. The core technical defect lies in the order of operations performed by the application when processing uploaded logos. Specifically, the system executes filesystem probes such as file_exists checks, MIME type detection via finfo or similar libraries, and EXIF data reading on the caller-supplied tmp_name parameter before verifying that the value corresponds to a genuine PHP-generated temporary upload file using is_uploaded_file. This inversion of validation logic allows an authenticated site-administrator user to bypass the security control intended to restrict input to legitimate uploads. By supplying arbitrary server-side file paths as the tmp_name parameter, the attacker forces the application to probe files outside the designated upload directory or those not originating from a client-side HTTP POST request with multipart/form-data encoding.
This architectural flaw creates a powerful oracle against the underlying operating system’s filesystem. Because the application returns distinct validation error messages depending on whether the specified path exists and what its image type is, an attacker can systematically enumerate files on the server. For instance, if the response indicates that a file does not exist or has an unsupported MIME type versus returning a different error related to upload integrity, the attacker gains binary information about the existence of specific paths. This capability transforms the application into a side-channel attack vector, enabling directory traversal and sensitive data discovery without requiring direct arbitrary file read permissions or code execution capabilities. The impact is strictly limited to disclosure; it does not permit reading file contents directly nor executing commands on the server.
From an industry standards perspective, this vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information useful for compromising the security of a system. It also relates closely to CWE-611, Improper Restriction of XML External Entity Reference, although in this context it is applied to local file inclusion logic rather than XML parsing. The behavior mirrors aspects of CWE-208 and CWE-205 regarding observable discrepancies in error responses that can be exploited for information gathering. In terms of the MITRE ATT&CK framework, this technique falls under T1083 File and Directory Discovery, where an adversary uses a compromised application to probe the local filesystem structure. The specific method of using distinct error messages based on file existence is characteristic of blind path traversal or oracle-based enumeration attacks often seen in web applications that fail to sanitize inputs before performing system-level operations.
The operational impact of this vulnerability is significant for organizations relying on MISP for threat intelligence sharing, particularly those with strict compliance requirements regarding data confidentiality and infrastructure secrecy. While the attacker cannot directly exfiltrate file contents or gain shell access, the ability to map the server’s filesystem can reveal critical information about installed software versions, configuration files, backup locations, and other sensitive artifacts. This reconnaissance phase is often a precursor to more severe attacks, such as identifying vulnerable services running on specific ports based on known installation paths or discovering hidden administrative interfaces. The requirement for site-admin privileges limits the attack surface to insider threats or compromised high-privilege accounts, but given that MISP instances are often central hubs in security operations centers, even limited information disclosure can have disproportionate consequences by aiding further lateral movement or targeted exploitation of other components within the infrastructure.
Mitigation strategies must address both the immediate code flaw and broader input validation practices. The primary fix involves reordering the validation logic so that is_uploaded_file is called before any filesystem probes are executed on the tmp_name parameter. This ensures that only files genuinely uploaded via PHP’s temporary file handling mechanism are processed, effectively neutralizing the oracle by preventing arbitrary path probing. Additionally, developers should implement strict allowlisting for allowed file extensions and MIME types rather than relying solely on detection libraries which can be spoofed or misinterpreted. Input validation should also include canonicalization checks to resolve symbolic links and relative paths before any system interaction occurs. From a defensive architecture standpoint, running the web application with minimal filesystem permissions limits the scope of what an attacker can discover even if such vulnerabilities exist. Regular security audits focusing on error handling mechanisms are essential to ensure that verbose or distinct error messages do not inadvertently leak internal state information about file existence or type detection outcomes.