Path Traversal Vulnerability in MISP Affects Organizations' Logo Handling

CVE-2026-95701

What is CVE-2026-95701?

In MISP, the __statisticsOrgs method in UsersController.php erroneously uses unvalidated organization names as file-system path components to check for an organization's logo image. The method constructs a path that could include attacker-controlled input. Given that the directory for organization logos was relocated in current MISP versions, this leads to a dormant vulnerability that if exploited, could allow an authenticated user with certain privileges to access arbitrary files on the server by injecting directory traversal sequences. This poses a significant risk as it could expose sensitive information.

References