CVE-2026-8080: MISP core - Stored XSS in MISP template (old engine) element attribute type
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.
This issue affects MISP before 2.5.37.
A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value.
This affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISP coreto a version that resolves this vulnerability.Fixed in 2.5.37 - Upgrade
Upgrade
MISP coreto a version that resolves this vulnerability.Fixed in 2.5.38
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8080?
CVE-2026-8080 is classified as a high severity vulnerability due to its stored cross-site scripting nature.
How do I fix CVE-2026-8080?
To fix CVE-2026-8080, upgrade MISP to version 2.5.37 or later.
What impact does CVE-2026-8080 have on the MISP application?
CVE-2026-8080 allows an attacker to inject malicious scripts that can execute in the context of other users in the MISP application.
What versions of MISP are affected by CVE-2026-8080?
All MISP versions prior to 2.5.37 are affected by CVE-2026-8080.
Is there a workaround for CVE-2026-8080 if I cannot upgrade MISP immediately?
Currently, there are no documented workarounds for CVE-2026-8080, so upgrading is the recommended solution.