CVE-2026-95698: MISP Path Traversal Vulnerability

CVE-2026-95698 Overview

CVE-2026-95698 is a path traversal vulnerability [CWE-22] in MISP's OrgImgHelper component. The findOrgImage method builds a filesystem path by concatenating a user-controlled organization identifier with the image directory and a file extension. It then calls file_exists() on the resulting path without sanitization. Because the Org.name field is attacker-controllable through event import, a crafted organization name containing traversal sequences resolves outside the intended directory. Exploitation requires an authenticated user with the ability to create or import events.

Critical Impact
Attackers gain an arbitrary file existence oracle and can read files with .png or .svg extensions accessible to the MISP process.

Affected Products

MISP (Malware Information Sharing Platform)
app/View/Helper/OrgImgHelper.php component
Instances allowing authenticated event creation or import

Discovery Timeline

2026-09-22 - CVE-2026-95698 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95698

Vulnerability Analysis

The findOrgImage method in OrgImgHelper iterates over the id, name, and uuid fields of the organization options array. For each field, it appends the raw value to the constant IMG_PATH and tests both .png and .svg extensions using file_exists(). When the file exists, the method returns the filename for rendering. The MISP event import workflow populates Org.name from untrusted event data, giving remote authenticated users control over the concatenated string. The absence of a basename() check or traversal filter allows the resolved path to escape the org-image directory.

The issue produces two distinct impacts. First, the boolean return of file_exists() acts as an oracle that reveals whether arbitrary paths exist on the server. Second, when a traversal target with a .png or .svg extension is served back to the requester, the attacker obtains file read primitives limited to those extensions.

Root Cause

The root cause is missing input validation on the organization identifier before it is used in filesystem operations. The code trusts field values that originate from event import payloads. No check enforces that the value equals its own basename() or excludes .. sequences.

Attack Vector

An authenticated attacker imports or creates a MISP event with an organization name containing directory traversal characters, such as ../../etc/passwd. When the UI or API subsequently renders that organization's logo, findOrgImage resolves the traversed path and returns any matching file with a .png or .svg extension. Files without those extensions can still be probed for existence.

php

         $image = null;
         foreach (['id', 'name', 'uuid'] as $field) {
             if (isset($options[$field])) {
+                // The field value becomes a filename under IMG_PATH, and the org
+                // name is attacker-controllable (event import sets Org.name), so
+                // reject anything that is not a plain filename component and could
+                // traverse out of the org-image directory.
+                $value = (string)$options[$field];
+                if ($value === '' || $value !== basename($value) || strpos($value, '..') !== false) {
+                    continue;
+                }
                 foreach (['png', 'svg'] as $extensions) {
-                    if (file_exists(self::IMG_PATH . $options[$field] . '.' . $extensions)) {
-                        $image = $options[$field] . '.' . $extensions;
+                    if (file_exists(self::IMG_PATH . $value . '.' . $extensions)) {
+                        $image = $value . '.' . $extensions;
                         break 2;
                     }
                 }

Source: MISP Security Patch Commit

Detection Methods for CVE-2026-95698

Indicators of Compromise

Event import payloads or API requests where Org.name contains .., /, or \ characters.
MISP application logs showing organization logo lookups that reference paths outside the configured image directory.
Web access logs recording org-image renders for organization names that are not valid filename components.

Detection Strategies

Inspect stored Org.name values for entries that do not match a strict filename allowlist such as ^[A-Za-z0-9._-]+$.
Correlate authenticated event import activity with subsequent requests that render organization logos or metadata.
Alert on file_exists() or filesystem access attempts targeting paths outside IMG_PATH in application-level tracing.

Monitoring Recommendations

Enable audit logging for event and organization creation, including the raw Org.name field value.
Monitor MISP API endpoints that expose organization objects for unusual response patterns tied to logo rendering.
Track authenticated user accounts that submit events with malformed organization names for potential abuse.

How to Mitigate CVE-2026-95698

Immediate Actions Required

Apply the upstream MISP patch that enforces basename() and rejects .. sequences in OrgImgHelper::findOrgImage.
Audit existing Org.name records and normalize or remove any values containing path separators or traversal sequences.
Restrict event creation and import privileges to trusted authenticated users pending patch deployment.

Patch Information

The fix is applied in app/View/Helper/OrgImgHelper.php and rejects any organization identifier that is empty, differs from its basename(), or contains ... Review the MISP Security Patch Commit and update to the corresponding MISP release.

Workarounds

Add a web application firewall rule to block event import payloads where Org.name contains .., /, or \.
Enforce server-side validation on the organization name field before persisting imported events.
Restrict filesystem permissions of the MISP process so that only the intended image directory is readable.

bash

# Example validation of Org.name values in the database
mysql -e "SELECT id, name FROM orgs WHERE name LIKE '%..%' OR name LIKE '%/%' OR name LIKE '%\\\\%';" misp