What’s Vulnerable › Vulnerabilities
CVE-2026-54394: MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-12 · updated 2026-06-17
- Weakness: CWE-22
Description
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
Affected products
- MISP: before 2.5.40 — fixed in 2.5.40
How to fix
Upgrade to a fixed version: MISP 2.5.40. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-54394 or the next vulnerability affects your stack