CVE-2026-54393
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk29th percentile — higher than 29% of all known CVEs
Summary
A stored XSS vulnerability exists in MISP when the Overmind theme is used. An authenticated user can store an arbitrary homepage value, including an XSS payload, leading to the execution of malicious JavaScript in the browser context.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious JavaScript in users' browsers, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update MISP to the latest version to ensure that homepage settings are always validated and properly secured before rendering.
Original NVD description (English source)
A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal(), bypassing the normal setSetting() validation logic, including validate_homepage, which requires homepage paths to start with /. As a result, an authenticated user could store an arbitrary homepage value, including an XSS payload. The stored value was later rendered in app/View/News/index.ctp as the href attribute of the “Continue to homepage” link without HTML escaping. This could allow execution of attacker-controlled JavaScript in the browser context of the affected MISP instance when the crafted homepage link is rendered and interacted with. The issue is fixed by always persisting the homepage setting through setSetting(), ensuring validation and access checks are applied, and by HTML-escaping the homepage value before rendering it in the news view.