MISP CVE-2026-94383

Requires MISP site-administrator privileges (PR:H) because the blocklist workflow module is role-restricted; the attacker triggers the workflow action with a crafted blocklist filename whose extension is not validated (only basename() and empty/dot checks applied). Actual code execution additionally requires that the underlying web server is configured to interpret and execute scripts from the MISP export directory - a non-default deployment/hardening condition that is the true gate on impact. No user interaction beyond triggering the action; affected versions are MISP <2.5.47.

This is a genuine RCE (CWE-434) but heavily gated by privilege: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N) requires site-administrator role, which the description confirms is enforced on the blocklist workflow module. The 8.6 score is driven by full CIA compromise of the web-server process, not by ease of reach - an attacker already holding MISP site-admin is a high trust bar, making this primarily a post-compromise privilege-to-OS escalation / insider-abuse issue rather than a broadly exploitable perimeter flaw. No EPSS, KEV, SSVC, or public POC data is provided, so exploitation is 'no public exploit identified at time of analysis.' A key limiting condition beyond privilege: exploitation only yields code execution IF the web server is configured to interpret/execute scripts from the MISP export directory - a non-default hardening-dependent precondition. The patch (extension allowlist) is confirmed available via the vendor commit. Net: real and worth patching promptly, but not an emergency for internet-facing mass exploitation given PR:H plus the server-config dependency.

A malicious or compromised MISP site-administrator triggers the blocklist workflow action with a crafted filename parameter carrying an arbitrary extension (e.g. a .php name), which basename()/empty-checks fail to reject, dropping an attacker-controlled script into the MISP export directory. If the web server executes scripts from that directory, the attacker requests the file to run arbitrary code as the web-server user. No public POC is identified; exploitation requires the pre-existing site-admin role and a script-executing export directory.