CVE-2026-104900: MISP Remote Event Preview XSS Vulnerability

CVE-2026-104900 Overview

CVE-2026-104900 is a stored cross-site scripting (XSS) vulnerability in Malware Information Sharing Platform (MISP) versions prior to 2.5.48. The flaw resides in the index table rendering of the remote event preview, specifically in the count field template at app/View/Elements/genericElements/IndexTable/Fields/count.ctp. The template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with permission to create or modify events on a linked remote MISP server can inject HTML or JavaScript into an event identifier. The payload executes in the browser of any local user who views the remote event preview index. The issue is classified as improper neutralization of input during web page generation [CWE-79].

Critical Impact
Successful exploitation results in arbitrary JavaScript execution in the context of an authenticated MISP user, enabling session hijacking, data exfiltration, and unauthorized actions through the web interface.

Affected Products

MISP versions prior to 2.5.48
Deployments with a linked or remote MISP server configured
Local MISP instances whose users view remote event preview index pages

Discovery Timeline

2026-10-02 - CVE CVE-2026-104900 published to the National Vulnerability Database
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104900

Vulnerability Analysis

MISP is a threat intelligence sharing platform that supports federated deployments through linked remote servers. The remote event preview feature allows users on a local instance to browse events hosted on a connected peer. The index view renders a count field for each event using a shared template. That template applied HTML escaping to the link URL but passed the raw field value directly to the output, breaking the output encoding contract.

Because event identifiers propagate from the remote peer, an attacker controlling or holding write access on a linked server can place HTML or JavaScript directly into the identifier. The payload is stored on the remote instance and delivered to the victim through the preview feed. The injected script runs with the privileges of the authenticated local user, including CSRF tokens, API keys surfaced through the UI, and permissions to modify events or users.

Root Cause

The root cause is missing HTML encoding of a server-controlled value during view rendering. In the vulnerable count.ctp template, the field value extracted through Hash::extract was concatenated into HTML without passing through the h() sanitizer, while only the link target received escaping. This selective escaping violates the principle of encoding every untrusted sink.

Attack Vector

Exploitation requires a network-reachable linked MISP server, authenticated write access on that remote server, and a victim user who browses the remote event preview index. No user interaction beyond navigating to the preview page is required, and no local privileges are needed by the attacker.

text

--- a/app/View/Elements/genericElements/IndexTable/Fields/count.ctp
+++ b/app/View/Elements/genericElements/IndexTable/Fields/count.ctp
 <?php
-    $fieldValue = Hash::extract($row, $field['data_path'])[0];
+    $fieldValue = h(Hash::extract($row, $field['data_path'])[0]);
     if (!empty($field['url'])) {
         if (!empty($field['url_params_data_path'])) {
             $data_path_params = [];

Source: MISP commit 2a2981a27. The fix wraps the extracted field value with h(), the CakePHP HTML-escaping helper, before rendering.

Detection Methods for CVE-2026-104900

Indicators of Compromise

Event identifiers or related metadata on remote MISP peers that contain <script>, on*= event handlers, or encoded HTML entities.
Unexpected outbound requests from analyst browsers to attacker-controlled domains after viewing the remote events preview page.
Unusual MISP API calls, event modifications, or user creations performed under an analyst account shortly after browsing a linked server.

Detection Strategies

Audit MISP server logs for GET requests to the remote events preview endpoint, correlated with event records on peers that contain HTML markup.
Scan the local MISP database and sync cache for stored event identifiers containing angle brackets, quotes, or JavaScript keywords.
Review Content Security Policy violation reports from the MISP web interface for inline script or external resource blocks.

Monitoring Recommendations

Enable detailed access logging on the MISP web tier and ship logs to a centralized analytics platform for retention and query.
Alert on web console sessions that execute administrative actions immediately after rendering remote preview pages.
Monitor the sync status and event feeds from each linked peer and flag identifiers that fail strict alphanumeric validation.

How to Mitigate CVE-2026-104900

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later on every instance that participates in server synchronization.
Review the trust relationships for each linked remote MISP server and revoke sync credentials for peers that are not strictly required.
Rotate API keys and session tokens for any analyst accounts that may have viewed malicious remote previews.

Patch Information

The fix is published in MISP commit 2a2981a27 and shipped in version 2.5.48. The patch modifies app/View/Elements/genericElements/IndexTable/Fields/count.ctp to wrap the extracted field value with the h() escaping helper. Deploy the upgrade through the standard MISP update process and restart the web server to load the patched view templates.

Workarounds

Temporarily disable the remote event preview feature or restrict access to the preview endpoint until the patch is applied.
Limit synchronization to vetted peers and enforce least privilege on user accounts that hold event creation rights on linked servers.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to blunt stored XSS payloads.

bash

# Upgrade MISP to the patched release
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout v2.5.48
sudo -u www-data git submodule update --init --recursive
sudo systemctl restart apache2