Path Traversal Vulnerability in MISP Object Template Handling

CVE-2026-77751

What is CVE-2026-77751?

A path traversal vulnerability exists in the handling of object template names within MISP when processing STIX 2 imports and exports. The issue arises when untrusted object names, potentially containing path traversal sequences such as '../', are passed into PyMISP's object-template resolution mechanism. This allows an attacker to escape the designated template directory and load arbitrary definition.json files from other locations accessible to the process. The vulnerability can be exploited repeatedly, as malicious names may be stored in MISP events, leading to filesystem access under altered security contexts. Stringent validation measures have been implemented to restrict object-template names, ensuring only safe components can be resolved, thus preventing potential malicious exploitation.

References