Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86347— MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

受影响的 MISP 版本允许任何经过身份验证的用户访问 ，因为 的 ACL 条目使用了通配符 。这使得本应用于相邻模板管理操作的角色限制被绕过。 该上传处理程序仅进行最基础的检查，接受任意内容，并将其写入 目录。因此，低权限或只读用户可以反复上传文件以消耗服务器磁盘空间，而无需 或 权限。修复方案是将 ACL 要求从 改为 。 该提交还排除了更严重的影响：上传的文件会被赋予随机名称，不存在路径遍历或可预测的覆盖问题；临时目录位于 Web 根目录之外；且这些文件不会通过 HTTP 直接对外提供访问。因此，该问题不应被

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86347

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring perm_add or perm_template. The fix changes the ACL requirement from * to perm_add. The commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should not be described as arbitrary file overwrite, stored XSS, or RCE. Version affected: ≤2.5.45
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.45 -

II. Public POCs for CVE-2026-86347

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86347

请登录查看更多情报信息。

Other References for CVE-2026-86347 (1)

Same Patch Batch · MISP · 2026-09-07 · 3 CVEs total

CVE-2026-86342 5.3 MEDIUM MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Inform
CVE-2026-86351 5.1 MEDIUM MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-862

V. Comments for CVE-2026-86347

No comments yet

Leave a comment