Invalid File Upload Logic in MISP Platform Affecting Security
CVE-2025-66384

8.2HIGH

Key Information:

Vendor

Misp

Status
Misp
Vendor
CVE Published:
28 November 2025

What is CVE-2025-66384?

MISP versions prior to 2.5.24 exhibit a flaw in the logic used to validate uploaded files. Specifically, the logic fails to properly check the 'tmp_name' of uploaded files, potentially allowing attackers to exploit this weakness to upload malicious files. This vulnerability underscores the importance of robust file validation mechanisms to safeguard web applications from potential security threats.

Affected Version(s)

MISP 0 < 2.5.24

References

https://github.com/misp/misp/commit/6867f0d3157a1959154bd...
https://github.com/MISP/MISP/compare/v2.5.23...v2.5.24

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.