CVE-2025-66386: MISP Path Traversal Vulnerability

CVE-2025-66386 Overview

CVE-2025-66386 is a path traversal vulnerability [CWE-23] in the Malware Information Sharing Platform (MISP) before version 2.5.27. The flaw resides in app/Model/EventReport.php and affects the view picture functionality available to site administrators. An authenticated site-admin can supply a crafted filename that escapes the intended picture directory and references arbitrary files on the server filesystem.

Critical Impact
An authenticated site-admin can traverse outside the picture folder to view files on the host, resulting in low-impact confidentiality disclosure with a changed scope.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to 2.5.27
app/Model/EventReport.php component
MISP deployments where site-admin accounts are provisioned

Discovery Timeline

2025-11-28 - CVE-2025-66386 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-66386

Vulnerability Analysis

The vulnerability exists in the EventReport model's picture viewing routine. The handler accepts a user-controlled filename value and concatenates it directly to the picture folder path without normalization. Because no basename reduction or path validation occurs, sequences such as ../ traverse outside PICTURE_FOLDER_PATH and resolve to arbitrary locations on disk.

Exploitation requires high privileges, specifically a site-admin account, and the attack is launched over the network. The impact is limited to reading image file contents that the MISP process can access, with no direct integrity or availability consequences. The scope is marked as changed because the resource accessed sits outside the component's intended security boundary.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The vulnerable code concatenates an attacker-controlled filename with a trusted base path and performs no sanitization. The upstream fix adds a basename() call that strips directory components from the supplied filename before the file lookup.

Attack Vector

A site-admin issues a request to the view picture endpoint with a filename containing traversal sequences. The server resolves the composed path and attempts to serve the referenced file. Successful exploitation discloses file contents to the requesting admin.

php

         if (!empty($imageFromAlias)) {
             $filename = $imageFromAlias;
         }
+        $filename = basename($filename);
         $filepath = self::PICTURE_FOLDER_PATH . '/' . $filename;
         $file = new File($filepath);
         if (!is_file($file->path)) {

Source: MISP Commit 7f4a0386

The patch inserts $filename = basename($filename); immediately before the path is constructed. This strips any directory separators from the supplied value, forcing the resolved path to remain inside PICTURE_FOLDER_PATH.

Detection Methods for CVE-2025-66386

Indicators of Compromise

HTTP requests to the EventReport view picture endpoint containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in the filename parameter
Web server access logs showing site-admin sessions requesting picture resources with unusual filename values
Application log entries referencing file reads outside the configured PICTURE_FOLDER_PATH

Detection Strategies

Inspect MISP access logs for requests to EventReport picture URLs containing traversal patterns or encoded path separators
Correlate site-admin authentication events with subsequent file read activity on the MISP host outside the pictures directory
Alert on process-level file access from the PHP interpreter touching sensitive paths such as /etc, configuration directories, or application secrets

Monitoring Recommendations

Enable web application firewall (WAF) rules that normalize and block traversal sequences in query and path parameters
Monitor privileged MISP account activity, including creation, login, and administrative API calls
Track MISP version strings exposed by the application to confirm all instances report 2.5.27 or later

How to Mitigate CVE-2025-66386

Immediate Actions Required

Upgrade MISP to version 2.5.27 or later, which includes the basename() sanitization fix
Review and reduce the number of accounts holding the site-admin role
Rotate credentials and audit recent site-admin activity for unexpected picture view requests

Patch Information

The fix is included in MISP 2.5.27. See the MISP v2.5.26 to v2.5.27 comparison and the security commit 7f4a0386 for the full change set. The patch applies basename() to the filename before path construction in app/Model/EventReport.php.

Workarounds

Restrict network access to the MISP administrative interface using IP allow-listing or VPN gating
Enforce multi-factor authentication for all site-admin accounts to raise the exploitation bar
Deploy WAF rules that reject requests containing traversal sequences in the EventReport picture endpoint

bash

# Verify MISP version meets the fixed release
cd /var/www/MISP
git describe --tags
# Expected output: v2.5.27 or later

# Upgrade MISP to the patched release
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v2.5.27