MISP CVE-2026-95701

Requires an authenticated MISP account with the privilege to create or rename an organisation (org-admin or site-admin), matching the vendor's PR:H. The attack is further limited by a critical precondition: the referenced logo directory (app/webroot/img/orgs) must exist for the file_exists() check to run at all - in current MISP deployments it does not, since org logos were moved to files/img/orgs, rendering the check dead and the vulnerability non-functional. Even when reachable, impact is confined to a boolean file-existence probe (confidentiality-only, VC:L) with no file read, write, or code execution.

This is a low-priority, largely theoretical issue despite the CWE-22 path-traversal classification. The vendor CVSS 4.0 vector (5.1, AV:N/AC:L/PR:H/UI:N/VC:L, all other impacts N) correctly reflects a confidentiality-only file-existence oracle requiring high privileges, and I concur with that low rating. The single most important mitigating signal is in the description itself: the vulnerable file_exists() check targeted app/webroot/img/orgs, a directory that no longer exists in current MISP deployments (org logos were relocated to files/img/orgs). The check was therefore functionally dead code and never triggered - meaning current installations are not actually exploitable; the fix hardens a latent pattern rather than closing an active hole. Exploitation additionally requires PR:H (an authenticated user able to create or rename an organisation, i.e. org-admin/site-admin). There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis. Net: no public exploit identified, no active exploitation, and the flaw is unreachable in shipped configurations - this is defensive hardening, not an operational priority.

An authenticated MISP user with organisation create/rename rights sets an organisation name to a traversal string such as '../../../../etc/passwd'; the __statisticsOrgs logo check would then call file_exists() on the resulting path and, only if the org-logo directory existed, reveal via the 'logo' flag whether that arbitrary file is present. In current MISP builds the referenced directory is absent, so the check never fires and nothing is disclosed. No public exploit code exists; the attack is a boolean file-existence oracle, not file read or code execution.