CVE-2026-94401High· 8.3▾ TwilightMISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was act…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.
If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.
The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.
Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.
Version affected: <2.5.47
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-27245High· 8.8An issue was discovered in MISP before 2.4.156
CVE-2020-28043High· 7.5MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
CVE-2026-94404High· 7.1MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protec…
CVE-2026-94393Medium· 6.4When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on o…
CVE-2026-94394Medium· 6.3When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of…
CVE-2026-94383High· 8.6The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension