Server-Side Request Forgery in MISP Modules by MISP

CVE-2026-125871

What is CVE-2026-125871?

The sourcecache expansion module in MISP Modules is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an authenticated user with permissions to create or modify attributes of type 'link' or 'url' to exploit the system by submitting a crafted URL. The module indiscriminately passes the URL to its internal archiving function without validating the target address, potentially targeting loopback addresses, private network ranges, or cloud metadata endpoints. As a result, the MISP server can unintentionally issue HTTP requests to these internal addresses, exposing sensitive information such as cloud credentials or internal application data to attackers. This oversight also permits the usage of non-HTTP schemes, like file://, which may lead to local file disclosure. The implications of this vulnerability are severe, as it can lead to significant information leakage from internal services accessible by the MISP server.

References