CVE-2026-94277: MISP Galaxy Matrix XSS Vulnerability

CVE-2026-94277 Overview

CVE-2026-94277 is a stored cross-site scripting (XSS) vulnerability in MISP, the open-source threat intelligence sharing platform. The flaw resides in the galaxy matrix statistics view at app/View/Users/statistics_galaxymatrix.ctp, where the galaxy name is rendered into HTML output through sprintf() without HTML encoding. An authenticated user with the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript. Any user who later opens the galaxy matrix statistics page executes the injected script in their browser session. MISP versions prior to 2.5.47 are affected.

Critical Impact
Successful exploitation enables session hijacking, credential theft, data exfiltration, and arbitrary actions performed on behalf of victim users within the MISP application.

Affected Products

MISP versions prior to 2.5.47
app/View/Users/statistics_galaxymatrix.ctp view component
Instances allowing users with the perm_galaxy_editor permission

Discovery Timeline

2026-09-21 - CVE-2026-94277 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94277

Vulnerability Analysis

The vulnerability is a stored XSS issue classified under [CWE-79], improper neutralization of input during web page generation. In the affected template, the galaxy name is passed as a substitution argument to sprintf() and echoed directly into the HTML body. Because MISP's CakePHP views require the h() helper for HTML entity encoding, the missing sanitization allows the raw value to persist in the DOM verbatim. Any attacker-controlled markup, such as <script> tags or event handler attributes, executes in the browser context of every user who visits the statistics page.

The attack is persistent rather than reflected. The malicious payload is stored in the MISP database as part of the galaxy record and executes on every subsequent view. Administrators and analysts loading routine statistics dashboards become high-value targets, as their sessions typically carry elevated privileges within the MISP instance.

Root Cause

The root cause is the absence of output encoding on the $galaxyName variable prior to interpolation into HTML. The affected line invokes sprintf(__('A heatmap showing the usage of %s.'), $galaxyName) without wrapping the value in the h() helper. Trust in the source of the galaxy name is misplaced because the perm_galaxy_editor permission allows lower-privileged authenticated users to set arbitrary content.

Attack Vector

Exploitation requires an authenticated session with the perm_galaxy_editor permission. The attacker creates or edits a galaxy and sets its name to a payload containing HTML or JavaScript. When any other authenticated user, including administrators, navigates to the galaxy matrix statistics view, the payload executes in their browser. This enables session token theft, forced API calls under the victim's identity, and pivoting to modify threat intelligence data.

text

// Patch diff from app/View/Users/statistics_galaxymatrix.ctp
     <?php
         echo $this->element('Users/statisticsMenu');
     ?>
-    <p style="margin-bottom: 40px;"><?php echo sprintf(__('A heatmap showing the usage of %s.'), $galaxyName);?></p>
+    <p style="margin-bottom: 40px;"><?php echo sprintf(__('A heatmap showing the usage of %s.'), h($galaxyName));?></p>

     <div style="height: 80px;">
         <div class="input select">

Source: MISP Commit 6b7637b. The fix wraps $galaxyName in the h() helper to HTML-encode the value before rendering.

Detection Methods for CVE-2026-94277

Indicators of Compromise

Galaxy records containing HTML control characters such as <, >, or " in the name field.
Galaxy names containing <script> tags, on* event handlers, or javascript: URIs.
Unexpected outbound HTTP requests from analyst browsers to attacker-controlled domains following visits to /users/statistics/galaxyMatrix.
Audit log entries showing galaxy create or edit actions performed by non-administrator accounts holding perm_galaxy_editor.

Detection Strategies

Query the MISP database for galaxy records whose name column matches regex patterns for HTML tags or JavaScript syntax.
Review web server access logs for requests to the galaxy matrix statistics endpoint correlated with recent galaxy modifications.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts.

Monitoring Recommendations

Continuously monitor MISP audit logs for galaxy create and edit events from accounts that do not normally curate galaxies.
Alert on browser-side CSP violations from users accessing MISP dashboards.
Track privilege assignments for perm_galaxy_editor and periodically review the list of accounts granted this permission.

How to Mitigate CVE-2026-94277

Immediate Actions Required

Upgrade MISP to version 2.5.47 or later, which includes the fix in commit 6b7637b.
Audit existing galaxies for names containing HTML or JavaScript payloads and remediate them before rendering statistics pages.
Review the list of users holding perm_galaxy_editor and remove the permission from accounts that do not require it.

Patch Information

The upstream fix is available in the MISP repository. The patch modifies app/View/Users/statistics_galaxymatrix.ctp to pass $galaxyName through the CakePHP h() helper, ensuring HTML entity encoding before output. See the MISP Commit 6b7637b for the full diff.

Workarounds

Temporarily restrict the perm_galaxy_editor permission to trusted administrators until the patch is applied.
Implement a strict Content Security Policy that disallows inline scripts to reduce the impact of injected payloads.
Manually sanitize galaxy name values in the database by stripping HTML tags and special characters until the upgrade is complete.

bash

# Verify the installed MISP version and pull the fix
cd /var/www/MISP
sudo -u www-data git fetch --all
sudo -u www-data git checkout v2.5.47
sudo -u www-data git log --oneline | grep 6b7637b