CVE-2026-95703

In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem. The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.

• CWE-20
• CWE-200

• https://github.com/MISP/MISP/commit/12eaadc9e

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95685MISP contains an access control flaw in the EventReports fun…5.3
• CVE-2026-95693In MISP, the EventReport::uploadPicture method in processed …5.3
• CVE-2026-95697MISP contains an authorization flaw in the Organisation mode…5.3
• CVE-2026-95698The findOrgImage method in MISP's OrgImgHelper constructs a …5.3
• CVE-2026-9570The Taskbuilder WordPress plugin before 5.0.8 does not prop…7.1
• CVE-2026-95701In MISP, the __statisticsOrgs method in UsersController.php …5.1
• CVE-2026-9571Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.1…6.5
• CVE-2026-9572A security vulnerability has been detected in GPAC up to 2.4…5.5
• CVE-2026-9573A vulnerability was detected in itsourcecode Student Transcr…7.3
• CVE-2026-9574A flaw has been found in itsourcecode Student Transcript Pro…7.3
• CVE-2026-9575A vulnerability has been found in itsourcecode Student Trans…7.3
• CVE-2026-95754In MISP's UsersController login() method, the pre-authentica…6.9