Is there a patch available for CVE-2026-54394?

Yes, a patch is available for CVE-2026-54394. Update the affected software to the latest version immediately.

MISP CVE-2026-54394

Q: What is the CVSS score of CVE-2026-54394?

CVE-2026-54394 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green. EPSS exploitation probability: 0.0%.

EUVD-2026-36563 MEDIUM

Path Traversal (CWE-22)

2026-06-12 CIRCL

GHSA-c4wp-7485-699w

Path Traversal Misp

5.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint, but PR:L required since attacker must hold a MISP account with organisation field write access; C:L only because only .png/.svg files are readable.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 21:26 vuln.today

Analysis Generated

Jun 12, 2026 - 21:26 vuln.today

DescriptionCVE.org

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.

AnalysisAI

Path traversal in MISP's OrganisationsController::getOrgLogo allows a low-privileged authenticated user to read arbitrary .png or .svg files from outside the intended organisation logo directory by injecting traversal sequences into organisation-controlled fields such as the organisation name, id, or uuid. All MISP versions prior to the patch commit b865deb are affected across any deployment where untrusted accounts hold write access to organisation fields. No public exploit code or CISA KEV listing exists at time of analysis; however, the attack requires only low-privilege access and no user interaction, making it practically exploitable in typical multi-tenant MISP deployments.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a PHP/CakePHP-based threat intelligence sharing platform. The flaw resides in the getOrgLogo action of app/Controller/OrganisationsController.php, which constructs filesystem paths by concatenating the base directory APP/files/img/orgs/ with attacker-influenced organisation fields (name, id, uuid) without normalization. Because PHP's file_exists() and the subsequent file-serving call resolve these paths natively, a field value containing ../ sequences causes the resolved path to escape the intended directory - the canonical CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) pattern. The commit diff confirms the pre-patch code literally does $path . $org['Organisation'][$field] . '.' . $extension with no sanitization. The fix introduces realpath() to resolve symlinks and directory traversal components, then performs a str_starts_with() prefix check against the resolved base path, which is the correct and standard mitigation for CWE-22. The CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* covers all MISP versions without a lower or upper bound, indicating all versions up to the patch commit are affected.

RemediationAI

Apply the upstream fix by updating MISP to a version that incorporates commit b865deb036ca82dab272be260798f562034ba9ae, available at https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae. Administrators should monitor the MISP GitHub releases page for a tagged release including this commit, as no specific patched release version was confirmed from available data. As a compensating control prior to patching, restrict write access to organisation fields (name, id, uuid) so that only trusted administrators - not members of external or untrusted organisations - can modify them; this removes the attacker's ability to inject traversal sequences at the cost of reduced self-service for organisation members. A web application firewall rule that blocks ../ and URL-encoded equivalents (%2e%2e%2f) in organisation-related API parameters provides an additional layer of defense, though WAF bypass via encoding variants remains possible without thorough normalization. The combination of restricting org field edits to admins and WAF-based input filtering represents the strongest compensating posture pending the patch.