CVE-2026-95703

In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem. The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.

• CWE-20
• CWE-200

• https://github.com/MISP/MISP/commit/12eaadc9e

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95697MISP contains an authorization flaw in the Organisation mode…5.3
• CVE-2026-95698The findOrgImage method in MISP's OrgImgHelper constructs a …5.3
• CVE-2026-95699Prior to 9/18/2026, the iSteamX mobile application's AWS pol…9.6
• CVE-2026-9570The Taskbuilder WordPress plugin before 5.0.8 does not prop…7.1
• CVE-2026-95701In MISP, the __statisticsOrgs method in UsersController.php …5.1
• CVE-2026-95702Use-after-free vulnerability in VFS in Google gVisor prior t…8.5
• CVE-2026-95704A vulnerability in the web-based management interface of wir…7.2
• CVE-2026-95705Command injection vulnerabilities in the affected interface …7.2
• CVE-2026-95706Command injection vulnerabilities in the affected interface …7.2
• CVE-2026-95707A buffer overflow vulnerability in the PAPI protocol of AOS-…7.2
• CVE-2026-95708Command injection vulnerabilities exist in the affected inte…7.2
• CVE-2026-95709Command injection vulnerabilities exist in the affected inte…7.2