File Handling Vulnerability in MISP Affects Users' Data Access

CVE-2026-94401

What is CVE-2026-94401?

MISP has identified a critical file handling issue that permits authenticated users, with permissions to modify data, to manipulate file uploads during XML import. This vulnerability arises due to a lack of proper validation for the imported content, allowing users to upload files containing local paths or external URLs. Consequently, the MISP platform can unintentionally read sensitive local files from its server or make unauthorized requests to internal network resources. This behavior enhances the risk of exposing confidential data within an organization's network, as exploitation can occur without the need for further user interaction beyond possessing valid access credentials.

References