CVE-2026-90957: MISP SVG XSS Vulnerability

CVE-2026-90957 Overview

CVE-2026-90957 is a stored Cross-Site Scripting (XSS) vulnerability in the Malware Information Sharing Platform (MISP) affecting versions ≤2.5.45. MISP serves uploaded SVG images inline without applying a restrictive browser sandbox. Because SVG is an XML document format rather than a passive bitmap, embedded <script> elements, event handlers, and javascript: URLs execute on the MISP origin when a user navigates directly to the file or when it is embedded through <object> or <iframe>. The affected use cases include organisation SVG logos and event-report SVG pictures. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A malicious SVG uploaded while SVG support was enabled remains dangerous on the serve path even after uploads are later disabled, allowing script execution under an authenticated viewer's session.

Affected Products

MISP versions ≤ 2.5.45
Organisation logo upload feature (SVG format)
Event-report picture upload feature (SVG format)

Discovery Timeline

2026-09-14 - CVE-2026-90957 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90957

Vulnerability Analysis

MISP allows authenticated users to upload SVG files for organisation logos and event-report pictures. When these files are subsequently served, the response does not include a restrictive Content Security Policy (CSP) sandbox directive. SVG files rendered through a normal <img> tag cannot execute scripts, but when a browser navigates directly to the SVG URL or the file is embedded via <object> or <iframe>, the browser treats the document as active content. Any <script> elements, DOM event handlers, or javascript: links inside the SVG then execute on the MISP origin with the viewer's session cookies.

Root Cause

The root cause is on the serve path, not the upload path. The controller returned uploaded files inline without neutralizing document-level script execution. The upload gate only decides what is stored; a file planted while SVG uploads were allowed continues to be served after uploads are turned off. The patch adds a sandboxInlineFile helper in RestResponseComponent.php that applies a CSP sandbox directive to inline SVG responses, giving the document an opaque origin and disabling script execution, plugins, and form submission while still permitting rendering.

Attack Vector

An authenticated attacker with permission to upload organisation logos or event-report pictures uploads a crafted SVG containing a <script> payload. When another user (potentially a higher-privileged administrator) navigates directly to the logo URL, the payload executes in the MISP origin context. This enables session theft, CSRF against MISP APIs, and pivoting inside the threat-intelligence platform.

php

// Patch: app/Controller/Component/RestResponseComponent.php
$cakeResponse->type('application/octet-stream');
$cakeResponse->type($type);
$cakeResponse->file($path, ['name' => $name, 'download' => $download]);
+       if (!$download) {
+           $this->sandboxInlineFile($cakeResponse, $type);
+       }
if (Configure::read('Security.disable_browser_cache')) {
    $cakeResponse->disableCache();
}
return $cakeResponse;

// Patch: app/Controller/OrganisationsController.php
if ($candidate !== false && $realBase !== false && str_starts_with($candidate, $realBase . DS)) {
    $this->response->file($candidate, ['download' => false, 'name' => $org['Organisation']['id'] . '.' . $extension]);
+   // An SVG logo is a document, not a bitmap: sandbox it so
+   // whatever it carries cannot run here when opened directly.
+   $this->RestResponse->sandboxInlineFile($this->response, $extension);
    return $this->response;
}

Source: MISP Security Commit 86496aecc

Detection Methods for CVE-2026-90957

Indicators of Compromise

SVG files in MISP storage directories containing <script> tags, on* event handler attributes, or javascript: URLs.
HTTP responses serving image/svg+xml content without a Content-Security-Policy: sandbox header.
Unexpected outbound requests originating from browser sessions after users viewed an organisation logo or event-report picture.

Detection Strategies

Scan the MISP files/ and organisation logo directories for SVG payloads matching regex patterns for <script, on\w+=, or javascript: within XML content.
Review MISP audit logs for SVG upload events (Organisation.logo, event-report attachments) performed by unusual accounts or immediately before administrator sessions.
Inspect web server access logs for direct GETs to /img/orgs/*.svg or event-report picture endpoints from authenticated user agents rather than embedded page loads.

Monitoring Recommendations

Alert on new SVG uploads to MISP instances and flag files that fail structural validation for XML script content.
Monitor for anomalous session activity such as API calls that follow shortly after a user opens an SVG asset URL.
Track HTTP response headers on MISP file-serving endpoints to confirm the sandbox CSP directive is present post-patch.

How to Mitigate CVE-2026-90957

Immediate Actions Required

Upgrade MISP to a version above 2.5.45 that includes commit 86496aecc.
Audit existing organisation logos and event-report SVG attachments for embedded scripts and remove or replace any suspicious files.
Restrict SVG upload permissions to trusted administrators until the patch is applied.

Patch Information

The fix is delivered in MISP commit 86496aecc, which introduces a sandboxInlineFile method in RestResponseComponent.php. The helper adds a CSP sandbox directive to inline-served SVG responses, granting an opaque origin and disabling scripts, plugins, and form submission while still allowing the image to render. Controllers serving logos and report pictures were updated to invoke this helper.

Workarounds

Disable SVG uploads in MISP configuration and convert existing SVG logos to raster formats such as PNG.
Deploy a reverse-proxy rule that appends Content-Security-Policy: sandbox and Content-Disposition: attachment headers to responses serving image/svg+xml.
Serve user-uploaded content from a separate sandbox domain that does not share cookies with the main MISP origin.

bash

# Nginx workaround: force sandbox CSP and attachment disposition on SVG responses
location ~* \.svg$ {
    add_header Content-Security-Policy "sandbox" always;
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
}