CVE-2026-95693: MISP Information Disclosure Vulnerability

CVE-2026-95693 Overview

CVE-2026-95693 is an information disclosure vulnerability in MISP, the open-source threat intelligence sharing platform. The flaw resides in the EventReport::uploadPicture method, which processes a caller-supplied tmp_name field by calling file_exists(), mime_content_type(), and exif_imagetype() before validating the input with is_uploaded_file(). An authenticated user holding the perm_add permission can supply an arbitrary filesystem path as the tmp_name value and observe distinct validation error messages that reveal file existence, MIME type, and image format on the MISP server.

Critical Impact
Authenticated attackers with the perm_add role can enumerate arbitrary filesystem paths on the MISP host, exposing sensitive locations such as configuration files and private keys to aid follow-on attacks.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to the commit 9a2a4acfe fix
Deployments exposing the event report picture upload endpoint
Instances granting the perm_add permission to non-administrative users

Discovery Timeline

2026-09-22 - CVE-2026-95693 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95693

Vulnerability Analysis

The vulnerability is classified as [CWE-22] Path Traversal and manifests as an information disclosure flaw. The EventReport::uploadPicture method in app/Model/EventReport.php accepts a tmp_name value from the request payload. Instead of first confirming that the path corresponds to a legitimate PHP-managed upload, the method immediately invokes file_exists(), mime_content_type(), and exif_imagetype() against the attacker-controlled path.

Each of these functions produces a distinct validation error message depending on the outcome. An attacker can therefore differentiate between a missing file, a file of an unexpected MIME type, and a non-image file. This oracle behavior allows enumeration of arbitrary paths on the MISP host.

The issue does not permit file content reads, writes, or code execution. Its practical value lies in reconnaissance, exposing filesystem layout details such as configuration files, credential stores, or private key locations that inform subsequent attacks.

Root Cause

The root cause is ordering: the application trusts a client-supplied filesystem path before verifying it originated from a legitimate multipart upload. PHP provides is_uploaded_file() specifically to defend against forged $_FILES['tmp_name'] values, but this check was applied after the probing calls.

Attack Vector

Exploitation requires an authenticated MISP account with the perm_add permission and network access to the event report picture upload endpoint. The attacker submits a crafted request that replaces the expected temporary upload path with a chosen filesystem path and observes the returned validation error to infer file presence and type.

php

// Security patch in app/Model/EventReport.php
// fix: [security] Reject a forged upload path in the event-report picture upload

        if ($picture['size'] > 0 && $picture['error'] == 0) {
+            // The submitted tmp_name must be a genuine PHP upload. Reject any
+            // forged path before it reaches file_exists()/mime_content_type()/
+            // exif_imagetype(), which would otherwise leak filesystem state
+            // through the distinct validation error messages below.
+            if (empty($picture['tmp_name']) || !is_uploaded_file($picture['tmp_name'])) {
+                $saveResult['errors'][] = __('File was not uploaded correctly');
+                return $saveResult;
+            }
            $extension = pathinfo($picture['name'], PATHINFO_EXTENSION);
            $pictureUUID = CakeText::uuid();
            $filename = sprintf('%s.%s', $pictureUUID, $extension);

Source: MISP commit 9a2a4acfe

Detection Methods for CVE-2026-95693

Indicators of Compromise

Repeated POST requests to the event report picture upload endpoint from a single authenticated user within a short time window.
Request payloads containing tmp_name values that reference absolute filesystem paths outside of PHP's configured upload temporary directory.
Elevated rates of picture upload validation errors correlated with the same user session or API key.

Detection Strategies

Inspect MISP application logs for uploadPicture invocations that return validation errors referencing file existence, MIME type, or image format checks.
Correlate authenticated user activity against the perm_add role with anomalous upload endpoint usage patterns.
Deploy web application firewall (WAF) rules that flag or block requests where the tmp_name field does not match the server's configured upload_tmp_dir.

Monitoring Recommendations

Alert on any user account generating a high volume of failed picture uploads with varied tmp_name paths.
Monitor filesystem access telemetry on the MISP host for reads of sensitive paths (for example, /etc/, private key directories, MISP configuration files) originating from the PHP-FPM or web server process.
Retain reverse proxy logs with full request bodies for the event report upload endpoint to support post-incident enumeration analysis.

How to Mitigate CVE-2026-95693

Immediate Actions Required

Apply MISP commit 9a2a4acfe, which inserts an is_uploaded_file() check before any filesystem probing in EventReport::uploadPicture.
Audit user accounts and reduce the assignment of the perm_add permission to only trusted operators.
Review MISP logs for suspicious upload activity that may indicate prior enumeration attempts.

Patch Information

The fix is available in the upstream MISP repository as commit 9a2a4acfe. The patch verifies that $picture['tmp_name'] is non-empty and that is_uploaded_file() returns true before invoking file_exists(), mime_content_type(), or exif_imagetype(). Requests with forged paths are rejected with a generic "File was not uploaded correctly" error, eliminating the oracle.

Workarounds

Restrict access to the MISP event report upload endpoint via reverse proxy access control lists while the patch is being deployed.
Temporarily revoke the perm_add permission from non-essential user roles until the patched version is in production.
Configure a WAF rule that rejects picture upload requests where the tmp_name parameter does not reside inside the PHP upload_tmp_dir.

bash

# Configuration example: pull and apply the upstream security fix
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git cherry-pick 9a2a4acfe
sudo -u www-data git status

# Verify the is_uploaded_file() guard is present
grep -n "is_uploaded_file" app/Model/EventReport.php