CVE-2026-90957: MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <img>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <script> elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.
The affected use cases include:
- organisation SVG logos; - event-report SVG pictures.
Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.
Version affected: ≤2.5.45
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable SVG logos unless required, because SVG files are XML documents and can remain dangerous even if uploads were later disabled. (Use the enable_svg_logos setting to leave SVG logo support off unless you need it.)
MISP enable_svg_logos = disabled - Configuration
Ensure the RestResponseComponent sandboxInlineFile() logic adds a Content-Security-Policy header when serving SVG inline (download=false; types svg, svgz, or image/svg+xml). This CSP should use the sandbox directive (opaque origin; disables script execution, plugins, and form submission) and restrictive default-src/style-src/img-src/font-src as described in the patch notes to prevent stored XSS.
MISP Content-Security-Policy (for inline-served SVG) = sandbox allow-same-origin; default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: - Configuration
Ensure the response includes the X-Content-Type-Options: nosniff header when serving affected content to help prevent MIME sniffing-related issues.
MISP X-Content-Type-Options = nosniff
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who directly navigate to or view an uploaded SVG as a document are exposed, because active SVG content can execute on the MISP origin using the viewer’s session. SVGs rendered only through a normal <img> element do not execute embedded scripts.
What does an attacker need to exploit it?
An attacker needs a malicious SVG to be present in an organisation logo or event-report picture location, and must cause a victim to open or embed that SVG as a document rather than merely render it through a normal image element.
Are systems still at risk if SVG uploads have been disabled?
Yes. The vulnerability is in how SVG files are served, and a malicious SVG uploaded while SVG support was enabled can remain dangerous after later disabling uploads.
How can I determine whether my MISP instance is affected?
Instances running MISP version 2.5.45 or earlier are affected. Review existing organisation logos and event-report pictures for uploaded SVG files, especially those added while SVG support was enabled.