CVE-2026-94277: Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
MISP's galaxy matrix statistics view (app/View/Users/statisticsgalaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the permgalaxyeditor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application.
Version affected: <2.5.47
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MISPto a version that resolves this vulnerability.Fixed in 2.5.47 - Configuration
In app/View/Users/statistics_galaxymatrix.ctp, apply CakePHP's h() to the $galaxyName variable before it is passed to sprintf() so galaxy names are HTML-encoded (e.g., angle brackets/quotes are percent-encoded/inert text) instead of rendered verbatim.
MISP app/View/Users/statistics_galaxymatrix.ctp HTML encoding of $galaxyName before sprintf() = Use CakePHP h() on $galaxyName before passing it to sprintf() for HTML output
Event History
Frequently Asked Questions
Who can exploit this issue, and who is affected by a malicious galaxy name?
An authenticated MISP user with the perm_galaxy_editor permission can create or modify a galaxy containing malicious markup. Any user who later opens the galaxy matrix statistics page can have that markup executed in their browser.
Are default MISP installations affected?
The issue requires an account with perm_galaxy_editor, so exposure depends on whether that permission is assigned. The vulnerable rendering occurs in the galaxy matrix statistics view.
What versions require remediation?
MISP versions earlier than 2.5.47 are affected. Updating to version 2.5.47 or later addresses the affected version range.
What can be done if an update cannot be applied immediately?
Restrict perm_galaxy_editor to trusted users and review galaxy names for HTML or JavaScript markup. Limit access to the galaxy matrix statistics page until malicious names have been removed or corrected.