CVE-2026-94401High· 8.3▾ TwilightMISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was act…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.
If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.
The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.
Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.
Version affected: <2.5.47
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-95679Medium· 6.9MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests
CVE-2022-27245High· 8.8An issue was discovered in MISP before 2.4.156
CVE-2020-28043High· 7.5MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
CVE-2026-112991Medium· 6.3MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
CVE-2026-112192Medium· 5.3MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
CVE-2026-112188High· 7.1MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution