MISP CVE-2026-95693

Requires an authenticated MISP account holding the perm_add permission (the role allowing event/attribute creation) - not administrative access, but not anonymous either. The attacker must be able to reach the event-report picture-upload code path and supply a controlled tmp_name value. Exploitation is limited to leaking file existence and type via differential error messages; it cannot read file contents, write files, or execute code, and affects only MISP versions prior to the fix in commit 9a2a4acfe. No user interaction beyond the attacker's own authenticated requests is needed.

This is a genuine but low-severity, low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, base 5.3, CWE-200) is internally consistent with the description: network-reachable, low complexity, requires an authenticated low-privilege account holding the perm_add role, and delivers only limited confidentiality impact (VI:N/VA:N - no integrity or availability effect). No EPSS score, KEV listing, or public POC is provided, so this is not confirmed as exploited. The impact ceiling is narrow: it is a filesystem existence/type oracle, not file-content disclosure, write, or code execution. The realistic risk is as a reconnaissance aid feeding a larger attack chain rather than a standalone critical flaw. No signals conflict - vendor CVSS, description, and patch diff all agree the flaw is an information-disclosure oracle gated behind authentication.

An attacker with a low-privilege MISP account that has the perm_add permission submits an event-report picture upload where the tmp_name field points to an arbitrary server path (e.g. /var/www/MISP/app/Config/config.php or an SSH private key). By observing whether MISP returns a 'file not found', a MIME-type, or an image-format validation error, the attacker learns whether that file exists and what type it is, mapping the host's filesystem and locating sensitive artifacts. No public exploit code is identified at time of analysis.