CVE-2026-54394
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile — higher than 23% of all known CVEs
Summary
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields, allowing an attacker to access files outside the intended directory.
Risk Assessment
An attacker could exploit this vulnerability to access arbitrary .png or .svg files, potentially leading to the disclosure of sensitive information. This poses a risk to the organization's data security.
Recommendation
It is recommended to update MISP to the latest version that fixes this vulnerability by using realpath() to verify file paths. Additionally, monitor and restrict access to organisation-controlled fields.
Original NVD description (English source)
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.