CVE-2026-95698: MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory.
This yields two security impacts:
- an arbitrary file existence oracle, since fileexists() returns a boolean for any path the process can access. - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.
The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add input validation in MISP OrgImgHelper::findOrgImage so each organization identifier (id, name, and uuid) is a non-empty plain filename component; reject values containing path separators, detected via basename comparison, or dot-dot sequences before constructing the filesystem path or calling file_exists().
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated and able to create or import events that set the organization name. The organization name supplied through event import is the attacker-controlled input used in path construction.
What data could be exposed through this issue?
An attacker can test for the existence of files accessible to the MISP process. Reading is limited to resolved files with .png or .svg extensions, which may then be rendered or served to the requesting user.