MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
Published Sep 22, 2026
5.3
MEDIUMCVSS 4.0
EPSS 0.72%
Description
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory.
This yields two security impacts:
- an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access. - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.
The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.
Affected products
-
- Version 0StatusaffectedConstraints<2.5.47
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
The fix adds input validation in findOrgImage so that each organization identifier value (id, name, uuid) is checked to be a non-empty plain filename component. Values containing path separators (detected via basename comparison) or dot-dot sequences are rejected, preventing the constructed path from escaping the designated org-image directory. The validated value is then used in the file_exists call and the returned image reference.
References (2)
Change history (0)
No recorded changes yet.