CVE-2026-54394: MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When serving organisation logo files, resolve the candidate file path using realpath() (or equivalent) and verify the resolved path is located under the intended base directory (APP/files/img/orgs/) before returning the file. Reject requests or return a safe error if the resolved path is outside the base directory.
MISP OrganisationsController::getOrgLogo path_resolution_and_validation = resolve candidate paths with realpath() and verify they remain under APP/files/img/orgs/
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54394?
The severity of CVE-2026-54394 is medium with a CVSS score of 5.3.
What kind of vulnerability is CVE-2026-54394?
CVE-2026-54394 is a path traversal vulnerability in the MISP platform.
How do I fix CVE-2026-54394?
To fix CVE-2026-54394, ensure that the application properly sanitizes input to prevent path traversal when retrieving organization logos.
What type of files can be retrieved using CVE-2026-54394?
CVE-2026-54394 allows the retrieval of arbitrary PNG and SVG files.
Which component of MISP is affected by CVE-2026-54394?
CVE-2026-54394 affects the OrganisationsController in MISP.