CVE-2026-54393: MISP Overmind theme stored XSS via unvalidated homepage setting
A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal(), bypassing the normal setSetting() validation logic, including validatehomepage, which requires homepage paths to start with /. As a result, an authenticated user could store an arbitrary homepage value, including an XSS payload.
The stored value was later rendered in app/View/News/index.ctp as the href attribute of the “Continue to homepage” link without HTML escaping. This could allow execution of attacker-controlled JavaScript in the browser context of the affected MISP instance when the crafted homepage link is rendered and interacted with.
The issue is fixed by always persisting the homepage setting through setSetting(), ensuring validation and access checks are applied, and by HTML-escaping the homepage value before rendering it in the news view.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the setHomePage endpoint to persist the user-supplied homepage via setSetting() rather than setSettingInternal(), ensuring validate_homepage and access checks are invoked; ensure validate_homepage requires homepage paths to start with '/'.
MISP Overmind theme homepage persistence = persist homepage via setSetting() so validation and access checks are applied - Configuration
In app/View/News/index.ctp, HTML-escape the persisted homepage value before inserting it into the href attribute of the 'Continue to homepage' link to prevent stored XSS.
MISP Overmind theme homepage rendering = HTML-escape homepage value before rendering in news view
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54393?
CVE-2026-54393 has a medium severity rating of 5.1 according to CVSS.
How do I fix CVE-2026-54393?
To fix CVE-2026-54393, you should apply the latest patch provided by MISP for the Overmind theme.
What type of vulnerability is CVE-2026-54393?
CVE-2026-54393 is a stored cross-site scripting (XSS) vulnerability.
Which software is affected by CVE-2026-54393?
CVE-2026-54393 affects the MISP Overmind theme in the MISP software.
What endpoint is involved in CSRF vulnerability CVE-2026-54393?
The endpoint involved in CVE-2026-54393 is the setHomePage endpoint, which does not properly validate user input.