MISP CVE-2026-94277

Exploitation requires an authenticated MISP account holding the specific perm_galaxy_editor permission to create or modify a galaxy name containing HTML/JavaScript (the injection vector). The payload only fires when a second user navigates to the galaxy matrix statistics page (app/View/Users/statistics_galaxymatrix.ctp), so victim user interaction is mandatory (UI:P). This limits realistic impact to multi-user MISP instances where at least one user has galaxy-editing rights and other users consult the statistics view; single-user or read-only-community deployments are not meaningfully exposed. Affected versions are MISP prior to 2.5.47; upgrading applies the h() output-encoding fix.

This is a stored/persistent cross-site scripting flaw (CWE-79) in MISP's galaxy matrix statistics view, rated by the vendor at CVSS 4.0 6.3 (medium). The signals are internally consistent and point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network reach but requires an authenticated attacker holding the elevated perm_galaxy_editor permission (PR:L) and requires the victim to actively open the statistics page (UI:P). The vulnerable-system impact is only VC:L/VI:L/VA:N, while the subsequent-system metrics are rated SC:H/SI:H - the vendor's way of capturing that the injected script runs in another user's authenticated browser context (session hijacking/credential theft). No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so exploitation status is 'no public exploit identified at time of analysis.' Real-world risk is bounded by the trust model: the attacker must already be a semi-privileged MISP user (galaxy editor) attacking fellow instance users, so this is primarily an insider/privilege-escalation-within-application concern rather than an unauthenticated internet-facing threat. The source-code diff (adding h() output encoding) independently confirms the root cause and the fix, raising confidence in the technical accuracy of the advisory.

An authenticated MISP user with the perm_galaxy_editor permission creates or renames a galaxy so its name contains a JavaScript payload (e.g. an image/script tag). When any other user - potentially an administrator - later opens the galaxy matrix statistics page, the unescaped name is interpolated via sprintf() into the HTML and the script executes in their session, enabling cookie/session theft or actions performed as the victim. No public POC was provided, but the single-line source diff makes the payload trivially reconstructable.