Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94277

Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name

CVSS 4.0 6.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94277

Published

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94277

Published

MISP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "modules": [
                        "app/View/Users/statistics_galaxymatrix.ctp"
                    ],
                    "product": "MISP",
                    "programFiles": [
                        "app/View/Users/statistics_galaxymatrix.ctp"
                    ],
                    "repo": "https://github.com/MISP/MISP",
                    "vendor": "MISP",
                    "versions": [
                        {
                            "lessThan": "2.5.47",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON