CVE-2026-94401

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead. If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network. The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services. Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed. Version affected: <2.5.47

• CWE-73
• CWE-918

• https://github.com/MISP/MISP/commit/d5f247b91

Published

Sep 21, 2026

Last Modified

Sep 21, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94396Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-94397Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-94398Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-94399Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-9440A vulnerability was identified in Edimax BR-6478AC 1.23. Aff…6.3
• CVE-2026-94400Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-94402IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cro…6.1
• CVE-2026-94403A weakness has been identified in ColorFul iGameCenter 1.0.3…8.8
• CVE-2026-94404MISP has a security issue that could let an attacker change …7.1
• CVE-2026-94405Authorization Bypass Through User-Controlled Key vulnerabili…5.3
• CVE-2026-94408Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…4.9
• CVE-2026-9441A security flaw has been discovered in Edimax BR-6478AC 1.23…6.3