Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-95698— MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name

Quick assessment

Affected

MISP MISP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 中 OrgImgHelper 的方法通过将用户提供的组织标识符、固定的图像目录路径以及文件扩展名拼接来构造文件系统路径，然后对生成的路径调用函数。通过事件导入功能可以控制组织名称字段（即设置）。由于在构造路径前未对该字段值进行任何验证，如果组织名称中包含目录遍历序列（例如），则会导致路径解析结果超出预期的目录范围。该漏洞导致以下两项安全影响：任意文件存在性预言机（Arbitrary File Existence Oracle）：由于对进程有权访问的任何路径都会返回布尔值，攻击者可以利用此特

CVSS 5.3 · Medium EPSS 0.72% · P54 Updated Sep 23, 2026

Possible ATT&CK Techniques 2 AI

T1562.008 T1083 · File and Directory Discovery

Affected Version Matrix 1

Vendor	Product	Version Range	Status
MISP	MISP	`< 2.5.47`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name

Source: CVE Program / CVE List V5

Vulnerability Description

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory. This yields two security impacts: - an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access. - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user. The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MISP	MISP	0 ~ 2.5.47	-

II. Public POCs for CVE-2026-95698

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-95698

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-95698 (1)

🔗 fix: [security] Reject path traversal in the org-logo filename lookup · MISP/MISP@e009860 · GitHub Read full article patch

https://www.cve.org/CVERecord?id=CVE-2026-95698

Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total

CVE-2026-95806	7.7 HIGH	MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influe
CVE-2026-95658	6.9 MEDIUM	MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o
CVE-2026-95754	6.9 MEDIUM	MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95679	6.9 MEDIUM	MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95667	6.9 MEDIUM	MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
CVE-2026-95697	5.3 MEDIUM	MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me
CVE-2026-95805	5.3 MEDIUM	MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric
CVE-2026-95671	5.3 MEDIUM	MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti
CVE-2026-95693	5.3 MEDIUM	MISP Information Disclosure via Forged Upload Path
CVE-2026-95674	5.3 MEDIUM	MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou
CVE-2026-95683	5.3 MEDIUM	MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95685	5.3 MEDIUM	MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95661	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type
CVE-2026-95665	5.1 MEDIUM	MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
CVE-2026-95703	5.1 MEDIUM	MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na
CVE-2026-95701	5.1 MEDIUM	MISP Path Traversal via Organization Name in Org-Statistics Logo Check
CVE-2026-95659	4.8 MEDIUM	MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
CVE-2026-95682	4.8 MEDIUM	MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

IV. Related Vulnerabilities

Same product: MISP

Same vendor: MISP

Same weakness: CWE-22