CVE-2026-86347: MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations.
The upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring permadd or permtemplate. The fix changes the ACL requirement from to permadd.
The commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should not be described as arbitrary file overwrite, stored XSS, or RCE.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in ≤2.5.45Patch MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion - Configuration
Change the ACL entry for TemplatesController::uploadFile from the wildcard '*' to require the perm_add permission so that only users with perm_add can upload template files.
MISP TemplatesController::uploadFile ACL ACL requirement for templates/uploadFile (wildcard '*' -> 'perm_add') = perm_add
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated MISP user, including low-privileged or read-only users, can reach the upload handler in affected versions. They do not need perm_add or perm_template.
Is a default installation affected?
The affected ACL entry uses a wildcard, so the vulnerable upload endpoint is available to any authenticated account unless access is separately restricted outside the described ACL behavior.
What is the practical impact of successful exploitation?
An attacker can repeatedly upload arbitrary file content to consume disk space in app/tmp/files/, potentially causing disk exhaustion. The available information rules out predictable file overwrite, path traversal, direct HTTP serving of uploaded files, stored XSS, and RCE through this issue.
What can be done before updating?
Restrict or disable access to TemplatesController::uploadFile() for accounts that do not require it, especially low-privileged and read-only users. Monitor available disk space and the app/tmp/files/ directory for unexpected file growth.
How can I determine whether an instance is affected?
MISP versions 2.5.45 and earlier are affected. Review whether templates/uploadFile is authorized with the wildcard ACL entry rather than requiring perm_add.