Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94401

MISP Arbitrary Local File Read and SSRF via MISP Export Upload

CVSS 4.0 8.3 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94401

Published

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead. If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network. The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services. Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed. Version affected: <2.5.47

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94401

Published

MISP

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "modules": [
                        "app/Model/Event.php (addMISPExportFile)"
                    ],
                    "product": "MISP",
                    "programFiles": [
                        "app/Model/Event.php"
                    ],
                    "repo": "https://github.com/MISP/MISP",
                    "vendor": "MISP",
                    "versions": [
                        {
                            "lessThan": "2.5.47",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON