CVE-2026-86440: MISP Dashboard Widget XSS Vulnerability

CVE-2026-86440 Overview

CVE-2026-86440 is a stored cross-site scripting (XSS) vulnerability in MISP (Malware Information Sharing Platform) affecting versions ≤2.5.45. The flaw resides in dashboard widget URL validation, specifically the Button widget. The previous renderer treated a URL as safe when it appeared relative or when its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous URL schemes and backslash-based authority forms that browsers normalize differently from PHP's URL parser. Attackers with permission to configure dashboard widgets can store javascript: URLs or backslash-prefixed hosts that execute in another user's browser session when they interact with the widget.

Critical Impact
Authenticated users can store malicious URLs in dashboard widgets that execute arbitrary JavaScript or redirect victims to attacker-controlled origins upon interaction.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤2.5.45
MISP dashboard Button widget component
Any MISP instance exposing configurable dashboard widgets to multiple users

Discovery Timeline

2026-09-07 - CVE-2026-86440 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86440

Vulnerability Analysis

The vulnerability is an improper input validation issue [CWE-20] leading to stored XSS in the MISP dashboard. Widget URLs are user-controlled configuration stored server-side. When another user loads the dashboard, the stored URL is rendered directly into an anchor tag's href attribute. Because the original validator only checked whether the URL was relative or whose parsed hostname matched the configured MISP host, dangerous schemes such as javascript:, data:, vbscript:, and file: reached the DOM. Additionally, browsers treat backslashes in the authority portion of a URL as forward slashes, so an input like /\evil.com/path is interpreted by PHP as a relative path but by browsers as navigation to evil.com. This parser differential enabled off-host navigation and script execution.

Root Cause

The root cause is inconsistent URL parsing between PHP's parse_url and browser URL normalization, combined with an allowlist that did not enforce scheme restrictions. The renderer trusted the parsed hostname without validating the scheme or rejecting control characters and backslashes.

Attack Vector

An authenticated user with dashboard configuration privileges stores a malicious URL in a Button widget. A second user viewing or clicking the widget triggers script execution or navigation to an attacker origin under the MISP application's context.

php

// Patch: DashboardURLValidator introduced and wired into ButtonWidget
// Source: https://github.com/MISP/MISP/commit/adf704e94

<?php

App::uses('DashboardURLValidator', 'Lib/Dashboard/Tools');

class ButtonWidget
{
    public $title = 'Button Widget';

php

// Validator rules (excerpt) - app/Lib/Dashboard/Tools/DashboardURLValidator.php
// Source: https://github.com/MISP/MISP/commit/adf704e94

/*
 * Rules:
 *   - Non-string / empty input                     -> null
 *   - Control characters (\\x00-\\x1f, \\x7f)         -> null
 *   - Any raw backslash                            -> null
 *     (browsers read `\` as `/` in the authority position,
 *      so `/\evil.com` is off-host)
 *   - javascript: / data: / vbscript: / file: schemes -> null
 *     (case-insensitive, leading whitespace tolerated)
 *   - Relative URLs (path / query / fragment only)  -> allowed
 */

Detection Methods for CVE-2026-86440

Indicators of Compromise

Dashboard widget configurations containing URLs starting with javascript:, data:, vbscript:, or file: schemes.
Stored widget URLs containing raw backslashes such as /\ or \\ in the authority position.
Widget URL values containing control characters in the range \\x00–\\x1f or \\x7f.
Unexpected outbound navigation from MISP dashboard sessions to non-MISP origins.

Detection Strategies

Audit the MISP database dashboards and users widget configuration tables for URL fields matching dangerous scheme patterns.
Review web server access logs for referer headers from /dashboard endpoints preceding requests to unexpected external hosts.
Enable and review Content Security Policy (CSP) violation reports for inline script executions originating from dashboard pages.

Monitoring Recommendations

Alert on modifications to dashboard widget configurations by non-administrative accounts.
Monitor MISP application logs for widget save events and correlate with subsequent user interactions.
Track authentication and session activity from users who load dashboards containing recently modified widgets.

How to Mitigate CVE-2026-86440

Immediate Actions Required

Upgrade MISP to the patched release that includes commit adf704e94 from the MISP GitHub repository.
Audit all existing dashboard widget configurations and remove entries containing javascript:, data:, vbscript:, file: schemes, or backslashes.
Restrict dashboard configuration privileges to trusted administrative accounts only.

Patch Information

The upstream fix routes all widget URLs through a shared DashboardURLValidator class. The validator rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins. Validation runs both in the widget handler and in the renderer to prevent bypass. Refer to the MISP security commit for the complete patch.

Workarounds

Disable the Button widget and other URL-accepting dashboard widgets until the patch is applied.
Enforce a strict Content Security Policy that blocks inline script execution and restricts navigation targets.
Limit user roles permitted to create or edit dashboard configurations to reduce the attack surface.

bash

# Verify installed MISP version and apply the upstream patch
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git log --oneline | grep adf704e94
sudo -u www-data git pull origin 2.5
sudo systemctl restart apache2