CVE-2026-95703: MISP Information Disclosure Vulnerability

CVE-2026-95703 Overview

CVE-2026-95703 affects Malware Information Sharing Platform (MISP), an open-source threat intelligence platform. The OrganisationsController::__uploadLogo method processes a caller-supplied tmp_name value with filesystem probes before verifying the upload origin. An authenticated site-admin user can supply an arbitrary server file path as the tmp_name parameter. The application returns distinct validation error messages based on file existence and image type, creating an oracle against the server filesystem. The flaw is categorized as improper input validation [CWE-20].

Critical Impact
A site-admin attacker can determine whether arbitrary paths exist on the MISP server and identify image file types, disclosing filesystem structure without arbitrary read or code execution.

Affected Products

MISP (Malware Information Sharing Platform)
OrganisationsController component handling organisation logo uploads
Instances prior to commit 12eaadc9e

Discovery Timeline

2026-09-22 - CVE-2026-95703 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95703

Vulnerability Analysis

The flaw resides in the MISP organisation logo upload workflow. When a site-admin submits a logo, the controller reads $this->request->data['Organisation']['logo'] and immediately performs filesystem operations on the client-controlled tmp_name field. These operations include file_exists, MIME type detection, and EXIF reading. Each of these functions returns different error paths depending on whether the target path exists and whether the referenced content is an image.

Because the application never calls is_uploaded_file before probing the path, an attacker can point tmp_name at arbitrary server-side files. The resulting validation error messages act as a side channel, disclosing filesystem structure. Exploitation requires site-admin privileges and does not permit arbitrary file read, code execution, or file modification.

Root Cause

The controller trusts a client-supplied tmp_name value that PHP normally sets from a genuine multipart upload. Without an is_uploaded_file guard, forged form data can substitute any path. The distinct branches of the validation logic then reveal filesystem state through their error messages.

Attack Vector

An authenticated site-admin submits a crafted multipart request to the organisation logo upload endpoint with tmp_name set to a chosen absolute path such as /etc/passwd or /var/www/html/config.php. By enumerating candidate paths and observing the returned error message, the attacker builds a map of file existence and image-type metadata on the host.

php

// Patch from app/Controller/OrganisationsController.php
$logo = $this->request->data['Organisation']['logo'];
if ($logo['size'] > 0 && $logo['error'] == 0) {
    // Only a genuine PHP upload may reach the filesystem probes below.
    // A forged tmp_name would otherwise leak file existence and image
    // type through the distinct validation messages that follow.
    if (empty($logo['tmp_name']) || !is_uploaded_file($logo['tmp_name'])) {
        return false;
    }
    $extension = pathinfo($logo['name'], PATHINFO_EXTENSION);
    $filename = $orgId . '.' . ($extension === 'svg' ? 'svg' : 'png');

Source: MISP GitHub commit 12eaadc9e

Detection Methods for CVE-2026-95703

Indicators of Compromise

Logo upload requests from site-admin accounts containing absolute filesystem paths in the tmp_name multipart field rather than PHP-generated temporary paths.
Repeated organisation logo submission attempts that generate a burst of distinct validation error responses tied to different path values.
Audit log entries showing organisation edit or logo upload actions with unusual frequency from a single site-admin session.

Detection Strategies

Inspect web server and application logs for POST requests to organisation logo endpoints where the referenced tmp_name falls outside the configured PHP upload_tmp_dir.
Correlate site-admin session activity with volumes of validation failure responses to identify enumeration behavior.
Baseline normal logo upload frequency per admin account and alert on statistical outliers.

Monitoring Recommendations

Enable MISP audit logging for all administrative actions and forward events to a central SIEM for correlation.
Monitor site-admin account creation, privilege changes, and login source diversity to reduce blast radius.
Track filesystem access patterns on the MISP host that correlate with HTTP request timing on the organisation endpoint.

How to Mitigate CVE-2026-95703

Immediate Actions Required

Apply the upstream MISP patch that introduces the is_uploaded_file guard in OrganisationsController::__uploadLogo.
Review the roster of site-admin accounts and remove any that are unnecessary or dormant.
Rotate credentials and API keys for site-admin users if suspicious upload activity is observed.

Patch Information

The fix is delivered in MISP commit 12eaadc9e. The patch adds an is_uploaded_file($logo['tmp_name']) verification before any filesystem probes execute. Operators should update to a MISP release that includes this commit. See the MISP GitHub commit 12eaadc9e for the full change.

Workarounds

Restrict site-admin role assignment to a minimal set of trusted operators until patching is complete.
Place the MISP administrative interface behind an authenticated reverse proxy or IP allowlist to limit exposure.
Enable multi-factor authentication for all site-admin accounts to raise the cost of credential compromise.

bash

# Update MISP to a release containing commit 12eaadc9e
cd /var/www/MISP
sudo -u www-data git fetch origin
sudo -u www-data git checkout 2.4
sudo -u www-data git pull origin 2.4
sudo -u www-data git log --oneline | grep 12eaadc9e