EUVD-2026-77467
GHSA-5mp5-7f8h-r69q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated upload (PR:L), victim must navigate to SVG as document (UI:R), stored XSS crosses user session boundary (S:C), limited C/I impact on victim context.
Primary rating from Vendor (5a6e4751-2f3f-4070-9419-94fb35b644e8).
CVSS VectorVendor: 5a6e4751-2f3f-4070-9419-94fb35b644e8
Lifecycle Timeline
3DescriptionCVE.org
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <img>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <script> elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer’s session.
The affected use cases include:
- organisation SVG logos;
- event-report SVG pictures.
Importantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.
Version affected: ≤2.5.45
AnalysisAI
Stored XSS in MISP ≤2.5.45 allows an authenticated user who can upload SVG files to plant malicious JavaScript that executes on the MISP origin when any other authenticated user navigates directly to the SVG URL (organisation logos or event-report pictures). Because the vulnerability lives in the serve path rather than the upload path, SVG payloads deposited while uploads were enabled remain exploitable even after SVG upload support is later disabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an authenticated MISP account with permission to upload SVG files - either as an organisation logo (typically organisation admin or above) or as an event-report picture. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-issued CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N = 5.1) accurately reflects the real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MISP to version 2.5.46 or later, which contains commit 86496aecc adding the `sandboxInlineFile()` CSP sandbox to all inline-served SVG responses. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today