CVE-2026-54394: MISP Path Traversal Vulnerability

CVE-2026-54394 Overview

CVE-2026-54394 is a path traversal vulnerability [CWE-22] in the Malware Information Sharing Platform (MISP). The flaw resides in the OrganisationsController::getOrgLogo method, which constructs organisation logo file paths from organisation-controlled fields (id, name, and uuid) without validating that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker who can influence an organisation field, such as the organisation name, can supply ../ sequences to read arbitrary .png or .svg files outside the logo directory.

Critical Impact
Authenticated attackers with the ability to set organisation fields can traverse the file system and retrieve arbitrary readable .png or .svg files from outside the organisation logo directory.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to the patched commit b865deb
Deployments exposing the organisation logo endpoint through OrganisationsController::getOrgLogo
Instances using the ui_beta theme are additionally exposed to a related cross-site scripting fix bundled in the same commit

Discovery Timeline

2026-06-12 - CVE-2026-54394 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54394

Vulnerability Analysis

The vulnerability exists in the getOrgLogo action of OrganisationsController. The controller concatenates organisation-controlled string fields onto the base directory APP/files/img/orgs/ and appends a .png or .svg extension, then serves the resulting file with $this->response->file(). Because the field values are not sanitised, an attacker who can set an organisation field to a value such as ../../../../AI-marketing causes PHP's file_exists() check to succeed against an arbitrary location, and the matching file is returned to the requester.

The attacker is constrained to files ending in .png or .svg and to paths readable by the web server process. Despite the extension constraint, the issue exposes any image asset stored elsewhere on the host, including images embedded in unrelated application directories or shared mount points.

Root Cause

The root cause is missing canonical path validation. The original code trusts user-controlled organisation metadata when building a file system path. PHP string concatenation does not collapse .. segments, and the file_exists() check only validates that the resolved file exists rather than where it lives. No allowlist, prefix check, or realpath() normalisation is applied before the file is streamed back to the client.

Attack Vector

Exploitation is network-based and requires low-privileged authentication, because organisation metadata is typically editable by users with organisation-administration rights. An attacker creates or modifies an organisation entry, sets a field such as name to a traversal payload, and then requests the organisation logo endpoint. MISP resolves the crafted path and returns the targeted .png or .svg file.

php

            throw new NotFoundException(__('Invalid organisation'));
        }
        $path = APP . 'files/img/orgs/';
-        $image = null;
+        $realBase = realpath($path);
        foreach (['id', 'name', 'uuid'] as $field) {
-            foreach (['png', 'svg'] as $extensions) {
-                if (file_exists($path . $org['Organisation'][$field] . '.' . $extensions)) {
-                    $this->response->file($path . $org['Organisation'][$field] . '.' . $extensions, ['download' => false, 'name' => $org['Organisation']['id'] . '.' . $extensions]);
+            foreach (['png', 'svg'] as $extension) {
+                $candidate = realpath($path . $org['Organisation'][$field] . '.' . $extension);
+                // realpath() resolves '..' and symlinks and returns false when the file does not
+                // exist; the prefix check rejects anything that escapes the orgs directory. Without
+                // it an attacker-controlled field such as the organisation name (e.g.
+                // '../../../../AI-marketing') would allow path traversal to arbitrary png/svg files.
+                if ($candidate !== false && $realBase !== false && str_starts_with($candidate, $realBase . DS)) {
+                    $this->response->file($candidate, ['download' => false, 'name' => $org['Organisation']['id'] . '.' . $extension]);
                    return $this->response;
                }
            }
        }
-        throw new NotFoundException(__('Organisation logo not found'));

Source: MISP commit b865deb

Detection Methods for CVE-2026-54394

Indicators of Compromise

Organisation records whose name, uuid, or id fields contain .., /, or \ characters
Web server access logs showing requests to the organisation logo endpoint that return non-logo content sizes or unexpected .svg/.png payloads
Audit log entries for organisation create or edit operations made shortly before logo requests originating from the same session

Detection Strategies

Query the MISP database for organisation rows where the name or uuid columns contain path traversal characters such as ../, ..\, or null bytes
Inspect HTTP access logs for requests to /organisations/getOrgLogo/ whose response sizes deviate from the typical organisation logo footprint
Correlate organisation modification events with subsequent logo retrievals from the same user account or IP address

Monitoring Recommendations

Enable file integrity monitoring on APP/files/img/orgs/ and adjacent directories to detect unusual read patterns
Forward MISP application logs and web server logs to a centralised analytics platform for traversal pattern detection
Alert on any organisation field update where the value fails a strict regex such as ^[A-Za-z0-9_.\- ]+$

How to Mitigate CVE-2026-54394

Immediate Actions Required

Update MISP to a build that includes commit b865deb036ca82dab272be260798f562034ba9ae or later
Audit existing organisation entries for traversal characters in name, uuid, and id fields and remediate any malformed values
Restrict organisation administration privileges to trusted users until the patch is applied

Patch Information

The fix resolves each candidate path with realpath() and verifies the result begins with the canonical base directory using str_starts_with($candidate, $realBase . DS). Candidates that fail the prefix check are rejected, and the controller throws NotFoundException instead of serving the file. Apply the patch from the MISP GitHub commit.

Workarounds

Temporarily disable or block external access to the /organisations/getOrgLogo/ route at the reverse proxy layer
Enforce input validation on organisation create and edit forms to reject values containing .., /, or \
Run the MISP web server process under a user account with read access limited to the application directory tree

bash

# Example nginx rule to block traversal sequences against the logo endpoint
location ~* /organisations/getOrgLogo/ {
    if ($request_uri ~* "(\.\./|\.\.\\)") {
        return 403;
    }
    proxy_pass http://misp_backend;
}