CVE-2026-54394

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.

• CWE-22

• https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54386marimo before 0.23.9 contains a reflected cross-site scripti…6.1
• CVE-2026-54387Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to …9.3
• CVE-2026-54388Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to …9.3
• CVE-2026-5439A memory exhaustion vulnerability exists in ZIP archive proc…7.5
• CVE-2026-54390JTL Shop versions 5.2.0 through 5.7.1 contains a server-side…9.8
• CVE-2026-54393A stored cross-site scripting vulnerability exists in MISP w…5.1
• CVE-2026-54395MISP contains a reflected cross-site scripting vulnerability…5.3
• CVE-2026-54396An information disclosure vulnerability exists in the MISP A…5.3
• CVE-2026-54397A vulnerability in MISP’s non-REST event editing path allowe…6.1
• CVE-2026-54398An authorization flaw in MISP’s object add/edit handling all…5.3
• CVE-2026-54399Uncontrolled Resource Consumption vulnerability in the HTTP/…7.5
• CVE-2026-5440A memory exhaustion vulnerability exists in the HTTP server …7.5