CVE-2026-95703: MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
In MISP, the OrganisationsController::uploadLogo method processed a caller-supplied tmpname value with filesystem probes (fileexists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via isuploadedfile. An authenticated site-admin user could supply an arbitrary server file path as the tmpname parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.
The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In MISP OrganisationsController::__uploadLogo, reject an empty tmp_name or a value that fails is_uploaded_file() immediately after the basic size/error check, before any filesystem probes such as file_exists, MIME detection, or EXIF reading.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated MISP user with site-admin privileges. Unauthenticated users and lower-privileged authenticated users are not described as able to trigger it.
What information can an attacker obtain?
A site administrator can test arbitrary server paths and distinguish whether they exist. For existing image files, the responses can also reveal the image type; the issue does not provide arbitrary file-content reading, modification, or code execution.
How can I determine whether an instance is affected?
Review whether the installed MISP code includes the fix from commit 12eaadc9e. The vulnerable behavior occurs when OrganisationsController::__uploadLogo performs file existence, MIME-type, or EXIF checks on a supplied tmp_name before confirming it with is_uploaded_file.