misp-stix EUVD-2026-63877

Exploitation during STIX 2 import requires that the attacker can supply a custom STIX object with a crafted x_misp_name value to the target MISP instance - concretely, by controlling or manipulating a STIX threat feed that MISP subscribes to and processes automatically, or by submitting content directly via a STIX import API endpoint if unauthenticated or attacker-authenticated access to that endpoint exists. The CVSS 4.0 PR:N rating reflects the feed-injection scenario where no MISP credentials are required from the attacker's perspective. For the confidentiality impact to materialize, a file named definition.json must exist at the traversal-resolved path and be readable by the OS user running the conversion process - absent such a file, the template resolution fails silently. The persistent variant requires that a MISP operator or automated process subsequently exports the poisoned event to STIX, re-invoking template resolution; this depends on normal MISP event lifecycle operations at the target site. Exploitation is bounded to organizations that have STIX 2 import or export functionality active in their MISP deployment and consume feeds from sources an attacker can influence.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) scoring 8.8 treats this as a network-accessible, low-complexity, unauthenticated flaw with high confidentiality impact. The PR:N assignment is valid for the STIX feed scenario: an attacker who controls upstream feed content does not need to authenticate directly to MISP to introduce malicious x_misp_name values. The VC:H rating is justified - any definition.json-named file readable by the conversion process (configuration fragments, credential files, application secrets) could be exfiltrated into a MISP event visible to event subscribers. No EPSS score was available; given the specialized deployment context and absence of KEV or POC, opportunistic mass exploitation is unlikely. However, the persistent re-triggering vector - where content introduced by a low-privilege import is re-processed during export by a higher-privilege context - creates an escalation pathway not captured by the static CVSS base score. Organizations that subscribe to partially-trusted or public STIX feeds and run exports with elevated permissions face the highest practical risk.

An attacker who controls or compromises a STIX 2 threat feed subscribed to by the target MISP instance crafts a custom STIX object with x_misp_name set to a traversal sequence such as ../../app/config (PyMISP appends definition.json automatically). When MISP processes the feed during STIX 2 import, PyMISP constructs the path misp_objects_path/../../app/config/definition.json, reads the targeted file if it exists, and copies its contents as template fields into the converted MISP event object - exfiltrating data visible to all event subscribers. If the poisoned event is later re-exported to STIX by an administrator process with broader filesystem access, the traversal is triggered a second time under elevated privileges, potentially reaching files inaccessible to the original import process.