EUVD-2026-83913
GHSA-2jvm-986q-589g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity, requires a low-privilege modify-capable account (PR:L); SSRF/file-read crosses into internal systems so S:C, confidentiality-only (C:H), no integrity or availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
3DescriptionCVE.org
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.
If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.
The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.
Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.
Version affected: <2.5.47
Articles & Coverage 1
AnalysisAI
Server-side request forgery and arbitrary local file read in MISP before 2.5.47 allow an authenticated user holding permission to add or modify data to upload content through the MISP export/import file handler that the server treats as a file locator rather than an XML document, causing MISP to read local files off the server or issue outbound requests to internal-only services. Assessed CVSS 3.1 is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (8.3 in the CNA's CVSS 4.0 vector), reflecting high confidentiality impact, scope change and no integrity or availability impact, with the blast radius on the SSRF branch bounded by what the MISP host can reach on the internal network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid MISP account with permission to modify/add data (PR:L) - read-only or unauthenticated users cannot reach the vulnerable XML import path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, non-inflated priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade MISP to 2.5.47 or later, the first release outside the affected <2.5.47 range; the specific corrective change is upstream commit https://github.com/MISP/MISP/commit/d5f247b91, which refuses uploaded content lacking a '<' character and calls Xml::build() with ['readFile' => false], neutralising both the file-read and SSRF branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every MISP instance, confirm the running version, and treat any deployment below 2.5.47 as exposed; temporarily restrict export/import file-handler access to the smallest possible set of trusted accounts and review recent add/modify activity for anomalous import requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today