CVE-2026-86347
Received Received - Intake

Authenticated User Disk Space Exhaustion in MISP

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CIRCL

Description
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts arbitrary content with only minimal checks and writes it into app/tmp/files/. A low-privileged or read-only user can therefore repeatedly upload files and consume server disk space without requiring perm_add or perm_template. The fix changes the ACL requirement from * to perm_add. The commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP. Therefore, the issue should not be described as arbitrary file overwrite, stored XSS, or RCE. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86347
EUVD
EUVD-2026-72322

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misp misp to 2.5.45 (inc)
misp misp 2.5.45

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP allows any authenticated user to upload files to the server's temporary directory due to an overly permissive ACL entry. The wildcard * in the ACL for templates/uploadFile bypassed intended role restrictions, letting low-privileged users upload arbitrary content without proper validation.

Detection Guidance

Check MISP logs for repeated file uploads by low-privileged users. Inspect app/tmp/files/ for unexpected files. Verify ACL configurations for templates/uploadFile in MISP's configuration files.

Impact Analysis

The main impact is excessive disk space consumption as attackers can repeatedly upload files. While direct code execution or data theft is unlikely, the server may run out of storage, leading to service disruption or denial of service.

Compliance Impact

This vulnerability primarily enables unauthorized disk consumption by any authenticated user, which could lead to denial-of-service conditions by exhausting server storage. While it does not directly expose sensitive data or violate confidentiality, it may impact system availability and integrity. GDPR and HIPAA focus on data protection, availability, and integrity, so this issue could indirectly affect compliance by disrupting system operations if exploited.

Mitigation Strategies

Update MISP to version 2.5.45 or later. Ensure the ACL for templates/uploadFile is set to require perm_add instead of wildcard access. Monitor disk usage in app/tmp/files/ to detect unauthorized uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart