CVE-2026-94401
Deferred Deferred - Pending Action

File Read Vulnerability in MISP

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead. If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network. The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services. Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94401
EUVD
EUVD-2026-83913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a file-handling vulnerability where authenticated users with modify permissions can upload files that are not actually XML. This allows them to supply a local file path or URL instead. If a local file path is provided, MISP reads the file. If a URL is given, MISP makes a request to it, including internal network services. This could expose sensitive files or allow unauthorized access to internal systems.

Detection Guidance

Check MISP server logs for unusual file read or network access attempts during XML uploads. Look for entries where the uploaded content contains file paths or URLs instead of valid XML. Verify if the MISP version is below 2.5.47, as this vulnerability affects versions prior to that.

Impact Analysis

An attacker with a valid MISP account and modify permissions could read sensitive files on the server or make requests to internal network services. This could lead to data breaches, unauthorized access to confidential information, or further exploitation of internal systems without needing additional user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected MISP versions may face legal penalties, reputational damage, and increased scrutiny for failing to protect personal or health data adequately.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later immediately. If immediate upgrade is not possible, restrict the 'perm_modify' privilege to trusted users only and monitor XML upload activities closely for suspicious patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94401. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart