Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77751— Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library

Quick assessment

Affected
misp misp-stix
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 STIX 2 导入和 MISP 到 STIX 2 导出过程中，MISP 对象模板名称的处理存在路径遍历漏洞。 MISP 对象名称被传递给 PyMISP 的对象模板解析机制，该机制通过拼接配置的 MISP 对象模板目录、对象名称和 definition.json 文件来构建文件系统路径。源自不受信任的 STIX 或 MISP 内容的对象名称在未受到充分限制的情况下被直接用于构建文件系统路径，从而引发安全问题。 攻击者若能提供包含路径分隔符（如 ）或路径遍历序列（如 ）的构造性对象名称，则可能导致模板解析机制跳出预

CVSS 8.8 · High EPSS 0.48% · P39

Affected Version Matrix 1

VendorProduct Version RangeStatus
misp misp-stix ≤ 2026.7.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77751

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template directory, the object name, and definition.json. An object name originating from untrusted STIX or MISP content was not sufficiently restricted before being used in this filesystem path. An attacker able to supply a crafted object name containing path separators or traversal sequences such as ../ could therefore cause template resolution to escape the expected template directory and attempt to load a definition.json file from another location accessible to the process. During STIX 2 import, an attacker-controlled x_misp_name from a custom STIX object could directly reach this template-resolution mechanism. The issue could also become persistent. A malicious object name stored in a MISP event could later be processed again during STIX 2 export. Consequently, content originally introduced in one security context could trigger filesystem access later when the event is exported by a process operating with different or greater privileges. If a suitable definition.json file exists outside the intended template directory, its contents may be interpreted as a MISP object template and fields from that file copied into the converted object. This can result in unintended disclosure of locally accessible data represented by the template file and modification of the resulting object's metadata or semantics. The patches introduce strict validation of object-template names. Valid names are restricted to a single path component containing letters, digits, hyphens, or underscores. Names that do not meet these requirements are replaced with the generic unknown-template name before reaching PyMISP template resolution. The original rejected name is preserved in the object's comment and a warning is generated, preventing traversal while retaining the source information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
misp misp-stix 0 ~ 2026.7.8 -

II. Public POCs for CVE-2026-77751

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9006 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-77751

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77751 (2)

Same Patch Batch · misp · 2026-08-21 · 4 CVEs total

CVE-2026-77755 8.7 HIGH Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-st
CVE-2026-77710 6.9 MEDIUM STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Inje
CVE-2026-77761 6.3 MEDIUM Cross-Document Parser State Contamination in misp-stix

IV. Related Vulnerabilities

Same product: misp-stix
Same vendor: misp
Same weakness: CWE-22

V. Comments for CVE-2026-77751

No comments yet

Leave a comment