CVE-2026-90895

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. Malicious scripts inside SVG can execute when the SVG is navigated to directly or embedded as a document, running on the MISP origin with the viewer's session. This affects organisation SVG logos and event-report SVG pictures. The vulnerable behavior is on the serve path, not merely the upload path. Version affected: ≤2.5.45.

Affected versions of MISP's interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45.

MISP version <= 2.5.45 contains a CSRF vulnerability in UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were added to the unlockedActions list, disabling all CSRF validation (both token and field-hash checks) for those endpoints, allowing an attacker to forge requests that change a logged-in user's settings.

MISP version ≤2.5.45 contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which renders MISP element references (attributes, objects, and tags) into inline HTML during PDF report export. User-controlled fields (attribute type and value, object name and relation, tag name and colours) are interpolated into HTML templates without HTML entity encoding. Additionally, the attribute() method contains hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, causing every plain attribute reference in a PDF to display the sample text rather than the actual indicator value.

An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.

In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.

The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination, and original request headers were reused, potentially forwarding authentication headers or API credentials to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results. The TAXII discovery endpoint had a related incomplete SSRF defense using gethostbyname() and comparing against only a few literal addresses, missing cases like IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null, which when passed to cURL effectively disabled TLS peer verification unless the calling code explicitly enabled it. As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.