Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-95682— MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

Quick assessment

Affected

MISP MISP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 在管理员邮件编辑界面存在一个存储型跨站脚本（XSS）漏洞。MISP 的组织名称设置被未转义地直接通过 PHP echo 语句插入了一个 JavaScript 字符串字面量中，代码如下：。由于该值被放置在一个双引号包裹的 JavaScript 字符串内，且未进行任何编码处理，因此如果组织名称中包含双引号字符（或反斜杠），就可以终止字符串字面量，并注入任意 JavaScript 代码到页面中。这段注入的脚本将在任何随后访问管理员邮件页面的已认证用户的上下文中执行，可能导致会话劫持、数据泄露或代表受害者执行特

CVSS 4.8 · Medium EPSS 0.42% · P36 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
MISP	MISP	`unspecified< 2.5.47`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

Source: CVE Program / CVE List V5

Vulnerability Description

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "<?php echo $org;?>";. Because the value was placed inside a double-quoted JavaScript string without any encoding, an organization name containing a double-quote character (or a backslash) could terminate the string literal and inject arbitrary JavaScript into the page. The injected script would execute in the context of any authenticated user who subsequently loads the admin email page, potentially allowing session hijacking, data exfiltration, or privileged actions performed on behalf of the victim. Exploitation requires the ability to set or modify the MISP.org organization name and a second authenticated user visiting the affected admin email view. The vulnerability is a classic instance of insufficient output encoding in a JavaScript context.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MISP	MISP	unspecified ~ 2.5.47	-

II. Public POCs for CVE-2026-95682

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-95682

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-95682 (1)

🔗 fix: [ui] Escape MISP.org when it is echoed into the admin email script · MISP/MISP@5d6ace6 · GitHub patch

https://www.cve.org/CVERecord?id=CVE-2026-95682

Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total

CVE-2026-95806	7.7 HIGH	MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe
CVE-2026-95754	6.9 MEDIUM	MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95658	6.9 MEDIUM	MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o
CVE-2026-95667	6.9 MEDIUM	MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
CVE-2026-95679	6.9 MEDIUM	MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95693	5.3 MEDIUM	MISP Information Disclosure via Forged Upload Path
CVE-2026-95805	5.3 MEDIUM	MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric
CVE-2026-95698	5.3 MEDIUM	MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95671	5.3 MEDIUM	MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti
CVE-2026-95685	5.3 MEDIUM	MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95674	5.3 MEDIUM	MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou
CVE-2026-95683	5.3 MEDIUM	MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95697	5.3 MEDIUM	MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me
CVE-2026-95661	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type
CVE-2026-95665	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
CVE-2026-95703	5.1 MEDIUM	MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na
CVE-2026-95701	5.1 MEDIUM	MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95659	4.8 MEDIUM	MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

IV. Related Vulnerabilities

Same product: MISP

Same vendor: MISP

Same weakness: CWE-79