---
id: CVE-2026-95701
title: >-
  In MISP, the __statisticsOrgs method in UsersController.php used the
  organization name directly as a file-system path component when checking for
  the existence of an organization logo image
summary: >-
  In MISP, the __statisticsOrgs method in UsersController.php used the
  organization name directly as a file-system path component when checking for
  the existence of an organization logo image. The original code called
  file_exists() with a …
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: MISP
product: MISP
affected:
  - MISP < 2.5.47
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:18:23.783'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95701'
references:
  - url: 'https://github.com/MISP/MISP/commit/a2f7cba6e'
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T14:59:24.647249Z'
cvssSource: cna
ingestedAt: '2026-09-22T15:05:01.082Z'
epss: 0.00763
epssPercentile: 0.53424
---

## Overview

In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called file_exists() with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs' . DS . $k . '.png', where $k is the organization name. Because the referenced directory (app/webroot/img/orgs) no longer exists in current MISP deployments (org logos were relocated to files/img/orgs), the check was functionally dead and never triggered. However, the underlying pattern—concatenating an attacker-influenced organization name into a file path without sanitization—constitutes a path traversal weakness. An organization name containing directory traversal sequences (e.g., '../../../../etc/passwd') would, if the target directory existed, allow an authenticated user with the ability to create or rename an organization to probe for the existence of arbitrary files on the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.