CVE-2026-95703
Deferred Deferred - Pending Action

Information Disclosure via File Probe in MISP

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem. The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95703
EUVD
EUVD-2026-84497

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MISP allows an authenticated site-admin user to probe the server filesystem for file existence and image types. The OrganisationsController::__uploadLogo method checked file properties like existence, MIME type, and EXIF data before verifying if the file was a valid PHP upload. This sequence created an oracle that leaked information about server files through distinct error messages.

Detection Guidance

This vulnerability requires authenticated site-admin access and exploits file probing via the MISP OrganisationsController::__uploadLogo method. Detection would involve monitoring for unusual file existence or image type probing attempts in MISP logs or through network traffic analysis of admin actions.

Impact Analysis

The impact is limited to information disclosure. An attacker with site-admin access could determine if specific files exist on the server and, for image files, their types. It does not allow file read, code execution, or modification of files.

Compliance Impact

This vulnerability does not directly violate GDPR or HIPAA as it does not allow arbitrary file read, code execution, or modification. However, it could indirectly impact compliance by enabling information leakage about server files, which may include sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. While this flaw does not directly expose such data, it could aid attackers in probing for sensitive files, potentially leading to further exploitation.

Mitigation Strategies

Apply the patch from the MISP GitHub commit (12eaadc9e) which reorders validation to check is_uploaded_file before filesystem probes. Ensure site-admin accounts are secured and limit access to trusted users only.

  • Update MISP to the latest patched version immediately.
  • Review and restrict site-admin privileges to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart