MISP EUVD-2026-84495

Requires an authenticated MISP user holding permission to create or import events that set the organisation name (Org.name), which is the attacker-controllable field flowing into OrgImgHelper::findOrgImage. The org-image rendering path must be triggered so file_exists() runs on the crafted path. Arbitrary read is limited to files ending in .png or .svg (the extensions appended during path construction) and to paths readable by the web process; the file-existence oracle works against any process-readable path regardless of extension. No user interaction beyond the attacker's own actions and no special non-default configuration are required - org images are standard MISP functionality. The authentication requirement (PR:L) is the primary factor limiting real-world exploitation.

This is a genuine but bounded vulnerability, correctly rated MEDIUM (vendor CVSS 4.0 5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L, confidentiality-only). The signals are internally consistent: network vector, low complexity, but PR:L means it requires an authenticated user able to create/import events that set Org.name - this is the real limiting gate. No EPSS score, no CISA KEV listing, and no public POC were provided, so per precision rules this is 'no public exploit identified at time of analysis.' There is no signal conflict: description (authenticated event import) matches the CVSS PR:L authentication requirement, and the impact (VI:N/VA:N, VC:L) matches the description's read-only oracle-plus-limited-read primitive. This is not a high-CVSS-but-low-real-risk mismatch - the score is already modest and honest. Priority is low-to-moderate: it is a post-authentication information-disclosure primitive in a niche security tool, not an unauthenticated RCE. The .png/.svg extension constraint further limits the arbitrary-read impact to files that happen to end in those extensions, though the file-existence oracle works against any process-readable path.

An authenticated MISP user with event-creation/import permission crafts an event whose organisation name contains directory-traversal sequences (e.g., '../../etc/passwd'), which is stored into Org.name. When the org image is rendered, findOrgImage concatenates the name into a filesystem path and calls file_exists(), letting the attacker probe for arbitrary files (existence oracle) or exfiltrate the contents of any .png/.svg file outside the org-image directory. No public POC is identified, and exploitation requires prior low-privilege authentication.