What is the CVSS score of EUVD-2026-84497?

EUVD-2026-84497 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-84497?

Yes, a patch is available for EUVD-2026-84497. Update the affected software to the latest version immediately.

MISP EUVD-2026-84497

| CVE-2026-95703 MEDIUM

Information Exposure (CWE-200)

2026-09-22 CIRCL

GHSA-f4j8-7jmm-g7jj

PHP Information Disclosure Oracle File Upload Misp

5.1

CVSS 4.0 · Vendor: CIRCL

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as site-admin
Delivery

Forge logo upload with arbitrary tmp_name path
Exploit

Server probes path before is_uploaded_file check
Execution

Distinct error reveals existence/image-type
Impact

Enumerate filesystem via repeated oracle queries

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated MISP site-admin account (PR:H) able to reach the organisation logo-upload endpoint (OrganisationsController::__uploadLogo). The attacker must forge the multipart tmp_name field to point at an arbitrary server path; the flaw exists on any version prior to the fix (commit 12eaadc9e) because the filesystem probes (file_exists, MIME detection, EXIF read) run before the is_uploaded_file validation. Limiting factors: exploitation is impossible without top-tier site-admin privileges, the oracle only discloses path existence and image type (no file contents, no write, no execution), and the fixed version closes it by rejecting any tmp_name that is not a genuine PHP upload.
Impact	This is a low-real-risk issue despite a moderate 5.1 CVSS 4.0 score. The vendor vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable but gated behind PR:H (site-admin), with confidentiality-only impact (VC:L) and no integrity or availability effect. The description's constraints match the vector - an authenticated site-admin can turn distinct validation error messages into a file-existence and image-type oracle, but cannot read file contents, execute code, or modify data. No EPSS score is provided, there is no CISA KEV listing, and no public POC is identified - so this is 'no public exploit identified at time of analysis.' Crucially, the attacker already needs the highest application privilege (site-admin), who typically has legitimate access to server configuration and diagnostics anyway, which sharply limits the marginal value of a filesystem oracle. The CVSS signals do not conflict with the description. Overall this is a low-priority, defense-in-depth hardening fix, not an urgent-patch scenario. Note: the input Tags include 'RCE', which is contradicted by the description's explicit statement that no code execution is possible.
Exploit ScenarioDerived	An authenticated MISP site-admin submits an organisation-logo upload request but replaces the multipart tmp_name with an arbitrary server path (e.g. /etc/passwd or /var/www/MISP/app/Config/config.php). The application probes that path with file_exists/MIME/EXIF before validating it was a genuine upload, and returns different validation errors revealing whether the path exists and, for images, its type - building a filesystem oracle. No public POC is identified; exploitation requires the highest privilege tier and yields only path/type disclosure.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 22, 2026

Authenticated MISP site administrators can abuse the organisation logo-upload handler (OrganisationsController::__uploadLogo) as a filesystem oracle, learning whether arbitrary server paths exist and, for image files, what image type is detected. The flaw affects versions prior to upstream fix commit 12eaadc9e and requires the highest privilege tier (site-admin), which is why it carries a moderate CVSS 4.0 score of 5.1 but low real-world risk. It exposes no file contents and provides no write, execution, or modification primitive, and no public exploit code has been identified at time of analysis.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit 12eaadc9e (https://github.com/MISP/MISP/commit/12eaadc9e) or upgrade to whatever MISP release first incorporates it, which adds an early is_uploaded_file() check that rejects any tmp_name not originating from a real PHP upload. Until the fix is deployed, the practical exposure is limited because exploitation requires a fully privileged site-admin account: restrict and audit site-admin membership, remove dormant admin accounts, and alert on repeated logo-upload requests that produce differing validation errors, since those are the oracle's signature. A stricter compensating control is to disable or block the organisation logo-upload endpoint entirely at the reverse proxy until patched; the trade-off is that administrators can no longer set organisation logos and any existing logo-management workflow breaks. If endpoints cannot be removed, terminate all sessions of untrusted admins and route admin traffic through a management network or IP allowlist - noting this only raises the bar, since an already-compromised admin retains the oracle. No arbitrary file read, code execution, or file modification is possible from this flaw, so cleanup after suspected abuse should focus on reviewing what path names an attacker may have probed rather than on hunting for web shells.

Affected VersionsENISA

MISP 0 <2.5.47

Affected Packages

euvd misp fix: 2.5.47

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The issue sits in MISP's PHP logo-upload flow, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). PHP populates the $_FILES superglobal from the multipart request, and the 'tmp_name' element is normally set by the interpreter to the path of a genuine uploaded temp file; the correct guard is is_uploaded_file(), which verifies the path really came from an upload before any further handling. MISP's __uploadLogo instead consumed the caller-supplied tmp_name directly and ran filesystem probes on it (file_exists, MIME type detection such as finfo/FINFO_MIME_TYPE, and EXIF reading), only later validating the value. Because the probes ran first, a forged tmp_name pointing at any server path produced distinct validation error messages: 'missing' versus 'wrong image type' versus image-type-specific errors. This turns the endpoint into a boolean/existence and image-type oracle. The upstream patch inserts an early check - if (empty($logo['tmp_name']) || !is_uploaded_file($logo['tmp_name'])) return false; - so only genuine PHP uploads reach the probe logic. The CPE cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* indicates the CPE feed carries no version constraints, consistent with the fix being delivered as a commit rather than a bounded version range in the advisory data. Note that the associated tag set includes 'RCE', but neither the description, the patch diff, nor the independent assessment describes any code-execution path; the observable primitive is disclosure only.

Know when Misp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CIRCL) PRIMARY 5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 2.7 LOW

Network-reachable endpoint but gated behind site-admin (PR:H); low confidentiality only (path/image-type oracle) with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.

The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Prevalence

Medium

MISP is a widely used but security-niche open-source threat-intelligence sharing platform

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Malicious File Upload HIGH

Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.