Is there a patch available for CVE-2026-54393?

Yes, a patch is available for CVE-2026-54393. Update the affected software to the latest version immediately.

MISP CVE-2026-54393

Q: What is the CVSS score of CVE-2026-54393?

CVE-2026-54393 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-36581 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 CIRCL

GHSA-4hg7-5g9q-5922

XSS Misp

5.1

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Authenticated attacker required (PR:L); victim must click crafted link (UI:R); XSS executes across browser scope boundary (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 21:26 vuln.today

Analysis Generated

Jun 12, 2026 - 21:26 vuln.today

DescriptionCVE.org

A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal(), bypassing the normal setSetting() validation logic, including validate_homepage, which requires homepage paths to start with /. As a result, an authenticated user could store an arbitrary homepage value, including an XSS payload.

The stored value was later rendered in app/View/News/index.ctp as the href attribute of the “Continue to homepage” link without HTML escaping. This could allow execution of attacker-controlled JavaScript in the browser context of the affected MISP instance when the crafted homepage link is rendered and interacted with.

The issue is fixed by always persisting the homepage setting through setSetting(), ensuring validation and access checks are applied, and by HTML-escaping the homepage value before rendering it in the news view.

AnalysisAI

Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.

Technical ContextAI

MISP is a PHP/CakePHP-based open-source threat intelligence sharing platform maintained by CIRCL and the MISP project. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) and involves two cooperating weaknesses: an input validation bypass and an output encoding omission. In UserSettingsController::setHomePage(), the code branched on the active theme: the Overmind path called setSettingInternal(), which writes the value directly to the database without triggering model-level validators such as validate_homepage (which enforces that paths begin with /), while the standard path correctly invoked setSetting(), which applies full validation and access checks. The persisted path was subsequently rendered verbatim in app/View/News/index.ctp using a bare PHP echo inside an href attribute, omitting CakePHP's h() HTML-escaping helper. CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* encompasses all MISP versions up to the upstream fix commit.

RemediationAI

Apply the upstream fix from commit d4733ca5d2fcceb12abc72ec6069f2484e3b8ec2 (https://github.com/MISP/MISP/commit/d4733ca5d2fcceb12abc72ec6069f2484e3b8ec2), which routes all setHomePage calls through setSetting() regardless of active theme and adds h() HTML-escaping to the homepage href rendering in the news view. A specific patched release version number is not confirmed beyond the upstream commit - monitor MISP release notes and the GitHub repository for a tagged release containing this change. If immediate patching is not possible, the most targeted compensating control is to disable the Overmind theme across the MISP instance (reverting to the default theme), which eliminates the vulnerable setSettingInternal() code path entirely; note this affects the UI appearance for users relying on Overmind. Alternatively, a WAF rule blocking non-slash-prefixed values in the setHomePage path parameter can prevent payload storage, though this introduces a dependency on WAF rule accuracy. Restricting MISP account creation to trusted personnel reduces the attacker pool, as exploitation of the storage step requires a valid authenticated session.