Reflected Cross-Site Scripting Vulnerability in MISP by Riskworry

CVE-2026-95659

What is CVE-2026-95659?

MISP has a reflected cross-site scripting vulnerability present within the AnalystDataController::viewForObject action. The vulnerability arises due to the acceptance of an unvalidated parent object type parameter from the URL, which is then rendered into HTML without output encoding. An authenticated user can be tricked into visiting a specially crafted URL, allowing an attacker to inject and execute arbitrary JavaScript in the user's browser within the MISP application context. This could enable the attacker to access session data, manipulate the page's content, or initiate actions on behalf of the victim. The affected versions of the application are below 2.5.47, and the vulnerability is particularly concerning as it requires user interaction to exploit.

References