CVE-2026-95698 MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
Authenticated attackers can exploit path traversal in MISP to read arbitrary PNG or SVG files and probe file existence via crafted organization names.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-95698?
CVE-2026-95698 is a medium-severity path traversal vulnerability in MISP, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory.
This yields two security impacts:
- an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access. - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.
The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.
Weakness: CWE-22
Which versions are affected by CVE-2026-95698?
How do I fix CVE-2026-95698?
No fix has been published for CVE-2026-95698 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-95698 being exploited?
There is no known exploitation of CVE-2026-95698 in the wild and no public exploit code.
Sources
Also known as GHSA-24qr-3pqh-xghm.