Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-95659— MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

Quick assessment

Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 在 操作中存在一个反射型跨站脚本（XSS）漏洞。该方法直接从 URL 中接收父对象类型参数而未进行任何验证，随后将其传入基于 Overmind 主题的 AnalystData 线程视图元素。在此过程中，该参数被嵌入到两个已翻译的字符串中，并未经输出编码直接渲染至 HTML 响应中。攻击者若能诱导已认证的用户访问构造的恶意 URL，即可注入可在 MISP 应用上下文中于受害者浏览器内执行的任意 JavaScript 代码。这可能导致攻击者读取会话数据、操控页面内容，或以受害者身份执行各种操作。 利用此漏洞需

CVSS 4.8 · Medium EPSS 0.39% · P33

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

VendorProduct Version RangeStatus
MISP MISP < 2.5.47 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-95659

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim's browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.  The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme's AnalystData thread element. Version affected: <2.5.47
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MISP MISP 0 ~ 2.5.47 -

II. Public POCs for CVE-2026-95659

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-95659

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-95659 (1)

Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total

CVE-2026-95806 7.7 HIGH MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe
CVE-2026-95658 6.9 MEDIUM MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o
CVE-2026-95754 6.9 MEDIUM MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95667 6.9 MEDIUM MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
CVE-2026-95679 6.9 MEDIUM MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95693 5.3 MEDIUM MISP Information Disclosure via Forged Upload Path
CVE-2026-95805 5.3 MEDIUM MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric
CVE-2026-95698 5.3 MEDIUM MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95671 5.3 MEDIUM MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti
CVE-2026-95685 5.3 MEDIUM MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95674 5.3 MEDIUM MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou
CVE-2026-95683 5.3 MEDIUM MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95697 5.3 MEDIUM MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me
CVE-2026-95661 5.1 MEDIUM MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type
CVE-2026-95665 5.1 MEDIUM MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
CVE-2026-95703 5.1 MEDIUM MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na
CVE-2026-95701 5.1 MEDIUM MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95682 4.8 MEDIUM MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

IV. Related Vulnerabilities

Same product: MISP
Same vendor: MISP
Same weakness: CWE-79