CVE-2026-95701
Deferred Deferred - Pending Action

Path Traversal in MISP via Organization Name

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called file_exists() with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs' . DS . $k . '.png', where $k is the organization name. Because the referenced directory (app/webroot/img/orgs) no longer exists in current MISP deployments (org logos were relocated to files/img/orgs), the check was functionally dead and never triggered. However, the underlying pattern—concatenating an attacker-influenced organization name into a file path without sanitization—constitutes a path traversal weakness. An organization name containing directory traversal sequences (e.g., '../../../../etc/passwd') would, if the target directory existed, allow an authenticated user with the ability to create or rename an organization to probe for the existence of arbitrary files on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95701
EUVD
EUVD-2026-84496

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP involves a path traversal weakness in the __statisticsOrgs method of UsersController.php. The method constructs a file path using an organization name without proper sanitization, allowing an attacker to probe for arbitrary files on the server by including directory traversal sequences like '../../' in the organization name.

Detection Guidance

Check MISP application logs for suspicious organization name patterns containing directory traversal sequences like '../'. Inspect file system access attempts in web server or application logs for paths containing 'orgs' with unusual characters. Review MISP configuration files for references to the old 'app/webroot/img/orgs' directory.

Impact Analysis

An authenticated user with organization creation privileges could exploit this to check for the existence of sensitive files on the server. While the immediate impact is limited to file probing, it could potentially lead to further attacks if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file access on the server. If exploited, it might enable an attacker to probe for sensitive files, which could lead to data breaches or unauthorized access to personal or health information. Compliance standards like GDPR require protection of personal data, and HIPAA mandates safeguards for protected health information. A path traversal flaw could undermine these protections.

Mitigation Strategies

Update MISP to the latest version that includes the fix for the org-statistics logo path. Verify that the application checks for logos in the correct directory 'files/img/orgs' instead of 'app/webroot/img/orgs'. Ensure the fix includes realpath prefix validation to prevent path traversal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart