CVE-2026-54394 Details
Description
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
A path traversal vulnerability has been identified in the OrganisationsController's getOrgLogo method within MISP. This issue arises because the code constructs file paths for organization logos using fields controlled by the organization, such as id, name, and uuid. The vulnerability exists because there is no validation to ensure that the resolved file paths remain within the designated APP/files/img/orgs/ directory. An attacker who can manipulate an organization field, like the organization name, could exploit this flaw to access arbitrary readable .png or .svg files from outside the intended directory. The vulnerability has been addressed by using realpath() to resolve candidate paths and verify that they stay within the expected base directory before serving the files.
Users can update to MISP version 2.5.40, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CIRCL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | CIRCL |