CVE-2026-95701: MISP Path Traversal Vulnerability

CVE-2026-95701 Overview

CVE-2026-95701 is a path traversal weakness [CWE-22] in Malware Information Sharing Platform (MISP). The __statisticsOrgs method in UsersController.php concatenated an organization name directly into a filesystem path when checking for an organization logo. Because the referenced directory app/webroot/img/orgs no longer exists in current deployments, the vulnerable file_exists() check was functionally dead. However, the unsanitized concatenation pattern would allow an authenticated user with organization creation or rename privileges to probe arbitrary file paths if the directory were restored.

Critical Impact
An authenticated high-privileged user can leverage crafted organization names containing ../ sequences to test for the existence of arbitrary files on the MISP server host.

Affected Products

MISP (Malware Information Sharing Platform)
app/Controller/UsersController.php component
Deployments retaining the legacy app/webroot/img/orgs directory

Discovery Timeline

2026-09-22 - CVE-2026-95701 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95701

Vulnerability Analysis

The flaw resides in the __statisticsOrgs method within UsersController.php. The controller constructed a filesystem path using the raw organization name to check for a corresponding logo image. The path was built as APP . 'webroot' . DS . 'img' . DS . 'orgs' . DS . $k . '.png', where $k originated from the organization name field. No sanitization stripped directory traversal sequences from $k before the path reached file_exists().

The weakness is currently non-exploitable in default installations because MISP relocated organization logos to files/img/orgs, so the target directory does not exist and file_exists() always returns false. The underlying anti-pattern remains a path traversal weakness that could be reactivated by any code change restoring the legacy directory.

Root Cause

The root cause is failure to validate or normalize user-controllable input before using it as a filesystem path component. Organization names accept arbitrary characters, including . and /, which enable traversal outside the intended img/orgs directory.

Attack Vector

Exploitation requires an authenticated account with permission to create or rename organizations. An attacker submits an organization name such as ../../../../etc/passwd\0 or similar, then triggers the statistics view. If the target directory existed, file_exists() would return a boolean indicating whether the probed file is present, producing an information disclosure oracle across the server filesystem.

php

        $orgs = $this->User->Organisation->find('all', array(
            'recursive' => -1,
            'conditions' => $conditions,
-            'fields' => array('id', 'name', 'description', 'local', 'contacts', 'type', 'sector', 'nationality'),
+            'fields' => array('id', 'name', 'uuid', 'description', 'local', 'contacts', 'type', 'sector', 'nationality'),
        ));
        $orgs = array_column(array_column($orgs, 'Organisation'), null, 'id');
        $users = $this->User->find('all', array(

Source: MISP commit a2f7cba6e. The patch points the logo lookup at the live files/img/orgs directory and hardens the identifier used in the path.

Detection Methods for CVE-2026-95701

Indicators of Compromise

Organization records whose name field contains ../, ..\\, null bytes, or absolute path prefixes such as /etc/ or C:\\.
MISP audit log entries showing organization create or rename events with unusual characters in the name field.
Repeated HTTP GET requests to the /users/statistics/orgs endpoint from a single authenticated session.

Detection Strategies

Query the organisations table for rows where the name column matches traversal patterns using regex on \.\./ or non-printable characters.
Alert on MISP application logs whenever __statisticsOrgs is invoked immediately after an organization create or update action from the same user.
Review web server access logs for POST requests to /organisations/add or /organisations/edit containing URL-encoded traversal sequences (%2e%2e%2f).

Monitoring Recommendations

Enable MISP audit logging and forward events to a centralized SIEM for correlation across identity and application layers.
Monitor filesystem access telemetry from the MISP host for file_exists calls resolving outside app/webroot/img/orgs and files/img/orgs.
Track privileged account usage patterns, focusing on accounts with perm_admin or perm_site_admin roles performing organization edits.

How to Mitigate CVE-2026-95701

Immediate Actions Required

Apply the upstream MISP patch referenced by commit a2f7cba6e to app/Controller/UsersController.php.
Audit existing organization records and rename any entries containing traversal characters or unexpected filesystem metacharacters.
Restrict organization creation and rename privileges to a minimal set of trusted administrators.

Patch Information

The fix is available in the MISP commit a2f7cba6e, which redirects the logo existence check to the live files/img/orgs directory and guards the identifier used in the constructed path. Operators should pull the latest MISP release incorporating this commit.

Workarounds

Confirm the legacy app/webroot/img/orgs directory does not exist on the host; if present, remove or relocate it so the dead-code branch cannot be reactivated.
Enforce input validation on organization names at the application boundary, rejecting names containing /, \\, .., or null bytes.
Apply web application firewall rules that block URL-encoded traversal sequences on MISP administrative endpoints.

bash

# Verify the legacy directory is absent and audit organization names
ls -ld /var/www/MISP/app/webroot/img/orgs 2>/dev/null || echo "Legacy directory absent - good"

mysql -u misp -p misp -e \
  "SELECT id, name FROM organisations WHERE name REGEXP '\\.\\./|\\\\\\\\|\\\\\x00';"