What is the CVSS score of CVE-2025-67906?

CVE-2025-67906 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of MISP are affected by CVE-2025-67906?

MISP versions before 2.5.28 contain a stored cross-site scripting vulnerability in workflow features that allows authenticated users with workflow privileges to inject malicious code.. A patch is available.

How to fix or mitigate CVE-2025-67906?

Within 24 hours: Inventory all MISP deployments and identify current versions. Within 7 days: Upgrade all instances to MISP 2.5.28 or later. Within 30 days: Audit workflow feature access logs for suspicious activity, verify all users are on patched versions, and communicate security advisory to MISP operators.

MISP CVE-2025-67906

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2025-12-15 cve@mitre.org

XSS Misp

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable web UI (AV:N), straightforward injection (AC:L), requires authenticated workflow-editor account (PR:L), needs victim to load page (UI:R), script crosses session/authorization boundary (S:C) with full session compromise.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 20:30 vuln.today

Analysis Generated

Jun 22, 2026 - 20:30 vuln.today

DescriptionNVD

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

AnalysisAI

Stored cross-site scripting in MISP (Malware Information Sharing Platform) versions before 2.5.28 allows authenticated users with workflow privileges to inject arbitrary JavaScript via the workflow execution path view (executionPath.ctp), where doT.js template expressions used unescaped interpolation. Successful exploitation against a user who views the affected page (UI:R) results in scope-changed compromise of the victim's MISP session, including high-confidentiality/integrity/availability impact (CVSS 9.0). Publicly available exploit code exists in researcher-published repositories; no CISA KEV listing at time of analysis.

Technical ContextAI

MISP is an open-source threat intelligence sharing platform written in PHP (CakePHP) with client-side templating provided by doT.js. In doT.js, the {{=expr}} syntax performs raw, unescaped interpolation, while {{!expr}} HTML-encodes the value. The pre-patch executionPath.ctp template rendered workflow node attributes (icon, icon_class, icon_path, name) through {{=}}, so any attacker-influenced workflow metadata was injected verbatim into the DOM - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) issue. The affected CPE is cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* covering all builds prior to 2.5.28.

RemediationAI

Vendor-released patch: upgrade to MISP 2.5.28 or later, which replaces unsafe doT.js {{=}} interpolation with HTML-escaped {{!}} interpolation in the workflow execution path template (fix commit https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054, release diff https://github.com/MISP/MISP/compare/v2.5.27...v2.5.28). If immediate upgrade is not feasible, restrict the workflow_user / site_admin roles to a minimum set of trusted operators so untrusted users cannot author workflow node metadata, audit existing workflows for suspicious icon/name fields, and consider deploying a Content Security Policy that disallows inline scripts on the MISP UI - note this may break other MISP UI components that rely on inline script and should be validated in staging. As a last resort, disabling the workflows feature in config.php prevents access to the vulnerable view but removes legitimate automation functionality.