CVE-2026-77751: MISP Path Traversal Vulnerability

CVE-2026-77751 Overview

CVE-2026-77751 is a path traversal vulnerability [CWE-22] in the MISP-STIX converter (misp-stix) affecting how MISP object template names are handled during STIX 2 import and MISP-to-STIX 2 export. Attacker-controlled object names reach PyMISP's template resolution mechanism, which joins the name into a filesystem path. An attacker supplying traversal sequences such as ../ can force template resolution to load a definition.json file from an unintended location. The contents of that file are then interpreted as a MISP object template, resulting in local information disclosure and modification of the resulting object's metadata.

Critical Impact
A crafted x_misp_name in a custom STIX object can be persisted in a MISP event and later trigger arbitrary file reads during export by a process operating with different or greater privileges.

Affected Products

MISP misp-stix converter (STIX 2 import path)
MISP misp-stix converter (MISP-to-STIX 2 export path)
Integrations relying on PyMISP object-template resolution via misp-stix

Discovery Timeline

2026-08-21 - CVE-2026-77751 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77751

Vulnerability Analysis

MISP object templates are stored as directories, with each template represented by a definition.json file inside a directory named after the template. PyMISP resolves templates by joining the configured object-template directory with the object name and definition.json. The misp-stix converter passed object names originating from untrusted STIX or MISP content into this resolution mechanism without validation.

A STIX 2 custom object carrying an attacker-controlled x_misp_name field is the primary entry point. The value flows through the custom-object converter and directly into PyMISP's template resolver. Because the name is concatenated into a filesystem path, sequences containing path separators or .. escape the intended template directory. If a definition.json file exists at the traversed location, its contents are parsed as a template and copied into the converted object.

Root Cause

The root cause is missing input validation on object-template names before they are used in filesystem path construction. The misp-stix code trusted names supplied through STIX imports and MISP events, treating any string as a valid single-component template name. Attacker-supplied names could contain /, \, or .. segments that PyMISP would resolve relative to the template root.

Attack Vector

The issue is exploitable through two paths. First, during STIX 2 import an attacker delivers a custom STIX object with a crafted x_misp_name that reaches template resolution directly. Second, the malicious name persists in the MISP event and is re-triggered during a later MISP-to-STIX 2 export, which may run under different privileges than the original import. This crosses security contexts and expands the set of files accessible to the exploit.

python

# Security patch: misp_stix_converter/tools/misp_object_templates.py
# Introduces strict validation of object-template names

import re
from typing import Any, Optional, Tuple

# A MISP object template is a directory named after the template, so a template
# name is a single path component. pymisp resolves a template by joining the
# name into a filesystem path (`misp_objects_path / name / 'definition.json'`),
# which means a name carrying separators or `..` segments reads a file outside
# the template directory and copies its fields onto the object.
_TEMPLATE_NAME_REGEX = re.compile(r'[A-Za-z0-9][A-Za-z0-9_-]*')

# Stands in for a name that cannot be a template name: the object is then built
# as a generic, template-less one, and the rejected name is kept as data.
_UNKNOWN_TEMPLATE_NAME = 'unknown-template'


def _is_template_name(name: Any) -> bool:
    """Tell whether a name is safe to hand to pymisp's template resolution."""
    return (
        isinstance(name, str)
        and _TEMPLATE_NAME_REGEX.fullmatch(name) is not None
    )

Source: GitHub MISP STIX Commit a8b6808d

Detection Methods for CVE-2026-77751

Indicators of Compromise

MISP objects containing a comment field referencing a rejected template name or the placeholder unknown-template, indicating traversal attempts that were blocked or logged
STIX 2 custom objects with x_misp_name values containing /, \, or .. sequences
MISP event exports that reference definition.json reads from paths outside the configured misp_objects_path
Process file-access telemetry showing the MISP or PyMISP process reading definition.json files from unexpected directories

Detection Strategies

Inspect STIX ingestion pipelines for custom objects whose name fields fail the pattern [A-Za-z0-9][A-Za-z0-9_-]*
Correlate MISP export logs with filesystem access events to identify template resolution outside the intended directory tree
Review historical MISP events for stored object names that would not pass the new sanitization regex, as those may be persistent payloads

Monitoring Recommendations

Enable filesystem auditing on the MISP object-template directory and alert on reads that resolve outside its canonical path
Monitor MISP application logs for warnings generated when object names are replaced with unknown-template
Track STIX import sources and rate of custom-object submissions containing non-conforming name fields

How to Mitigate CVE-2026-77751

Immediate Actions Required

Update the misp-stix package to a version containing commits a0f54070 and a8b6808d
Audit existing MISP events for stored object names that contain path separators or traversal sequences and remediate before re-export
Restrict filesystem permissions on the process running MISP-to-STIX conversions so that only the intended template directory is readable

Patch Information

The fix introduces strict validation of object-template names. Valid names must match a single path component of letters, digits, hyphens, or underscores. Non-conforming names are replaced with the generic unknown-template before reaching PyMISP, and the original rejected name is preserved in the object's comment along with a warning. The relevant commits are MISP STIX Commit a0f54070 covering the STIX 2 export path and MISP STIX Commit a8b6808d covering the STIX 2 import path.

Workarounds

Sanitize incoming STIX 2 content at the ingestion boundary, rejecting custom objects whose x_misp_name contains characters outside [A-Za-z0-9_-]
Run MISP import and export processes with least-privilege filesystem access, isolating the template directory from other sensitive data
Disable ingestion of untrusted STIX 2 custom objects until the patched misp-stix release is deployed

bash

# Verify installed misp-stix contains the sanitisation module
python3 -c "from misp_stix_converter.tools.misp_object_templates import _UNKNOWN_TEMPLATE_NAME; print(_UNKNOWN_TEMPLATE_NAME)"

# Expected output: unknown-template
# If the import fails, the installed version predates the fix and must be upgraded.