CVE-2026-95693 (GCVE-0-2026-95693)
Vulnerability from cvelistv5 – Published: 2026-09-22 14:22 – Updated: 2026-09-22 15:09
VLAI
EPSS
VEX
Title
MISP Information Disclosure via Forged Upload Path
Summary
In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.
This constitutes an information disclosure vulnerability: the server's filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.
The vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:09 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/9a2a4acfe | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-22 14:16 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/9a2a4acfe.patch
0a64cbcd6700… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
9a2a4acfe71e
|
fix: [security] Reject a forged upload path in the | 0a64cbcd6700… |
Fix summary
The fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration.
Patch summary
In app/Model/EventReport.php, eight lines are inserted at the top of the upload-processing block (after the size/error check). The added code verifies that $picture['tmp_name'] is non-empty and passes is_uploaded_file(). If either condition fails, a generic 'File was not uploaded correctly' error is appended to $saveResult['errors'] and the function returns early, before pathinfo, file_exists, mime_content_type, or exif_imagetype are ever called on the untrusted path.
CVSS rationale
AV:N: MISP is a web application accessed over the network. AC:L: The attack requires only crafting a request with a different tmp_name value; no race conditions or complex setup are needed. AT:N: No prior user interaction or attack complexity beyond the request is required. PR:L: The attacker needs an authenticated account with the perm_add permission, which is a low-privilege role in MISP (not admin). UI:N: No victim interaction is required. VC:L: File existence and type information is disclosed, but file contents are not readable. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: No impact on subsequent components.
Weakness rationale
- CWE-200 The primary security impact is the disclosure of filesystem state (file existence and type) through distinct error messages, which is a classic information exposure weakness. The attacker does not read file contents but learns metadata about arbitrary paths.
- CWE-22 The caller-supplied tmp_name was used as a filesystem path without restricting it to the upload directory. Although the impact here is information disclosure rather than full file read/write, the root cause is the lack of path restriction, making CWE-22 a contributing weakness.
Attack pattern rationale
- CAPEC-177 The attacker manipulates the tmp_name parameter to reference file paths outside the intended upload directory, causing the server to probe arbitrary locations. Although the observable effect is information disclosure rather than full file read, the mechanism is path traversal: the application uses an untrusted path string to access the filesystem. CAPEC-177 is the closest available pattern; the uncertainty is that the impact is limited to metadata disclosure rather than full traversal read, but no more specific CAPEC exists for 'path probing via error-message oracle'.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 49 commits after fix), suggesting versions prior to the fix commit are vulnerable. No explicit version range is stated in the patch.
- PR:L is assumed because the commit message specifies 'any perm_add user', which is a non-admin role in MISP. The exact privilege level mapping to CVSS PR is an assumption.
- VC:L is assigned because the disclosure is limited to file existence and type metadata, not full file contents. If the information disclosed is considered more sensitive in a specific deployment, VC could be rated higher.
- CAPEC-177 (Path Traversal) is the closest available pattern; the actual impact is an information-disclosure oracle rather than a full traversal read, so the mapping is approximate.
- The Co-Authored-By line credits an AI assistant (Claude Opus 4.8) as a remediation developer. This is recorded as supplied in the metadata but is atypical for CVE credit.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | medium | 5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95693",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:09:40.847048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:09:48.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"EventReport"
],
"product": "MISP",
"programFiles": [
"app/Model/EventReport.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis constitutes an information disclosure vulnerability: the server\u0027s filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host.\u003c/p\u003e"
}
],
"value": "In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.\u00a0\n\nThis constitutes an information disclosure vulnerability: the server\u0027s filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.\u00a0\n\nThe vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host."
}
],
"impacts": [
{
"capecId": "CAPEC-177",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-177 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T14:22:28.896Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/9a2a4acfe"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration.\u003c/p\u003e"
}
],
"value": "The fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration."
}
],
"title": "MISP Information Disclosure via Forged Upload Path",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 49 commits after fix), suggesting versions prior to the fix commit are vulnerable. No explicit version range is stated in the patch.",
"PR:L is assumed because the commit message specifies \u0027any perm_add user\u0027, which is a non-admin role in MISP. The exact privilege level mapping to CVSS PR is an assumption.",
"VC:L is assigned because the disclosure is limited to file existence and type metadata, not full file contents. If the information disclosed is considered more sensitive in a specific deployment, VC could be rated higher.",
"CAPEC-177 (Path Traversal) is the closest available pattern; the actual impact is an information-disclosure oracle rather than a full traversal read, so the mapping is approximate.",
"The Co-Authored-By line credits an AI assistant (Claude Opus 4.8) as a remediation developer. This is recorded as supplied in the metadata but is atypical for CVE credit."
],
"capecRationale": [
{
"capecId": "CAPEC-177",
"rationale": "The attacker manipulates the tmp_name parameter to reference file paths outside the intended upload directory, causing the server to probe arbitrary locations. Although the observable effect is information disclosure rather than full file read, the mechanism is path traversal: the application uses an untrusted path string to access the filesystem. CAPEC-177 is the closest available pattern; the uncertainty is that the impact is limited to metadata disclosure rather than full traversal read, but no more specific CAPEC exists for \u0027path probing via error-message oracle\u0027."
}
],
"commit": "9a2a4acfe71eaacfe9305a89483d45772edf16b4",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: MISP is a web application accessed over the network. AC:L: The attack requires only crafting a request with a different tmp_name value; no race conditions or complex setup are needed. AT:N: No prior user interaction or attack complexity beyond the request is required. PR:L: The attacker needs an authenticated account with the perm_add permission, which is a low-privilege role in MISP (not admin). UI:N: No victim interaction is required. VC:L: File existence and type information is disclosed, but file contents are not readable. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: No impact on subsequent components.",
"fixSummary": "The fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration.",
"generatedAt": "2026-09-22T14:16:43.440374Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "0a64cbcd67009e5af0b74721071bfaf4a36c3cac59e13128eaae04545009886a",
"patchSummary": "In app/Model/EventReport.php, eight lines are inserted at the top of the upload-processing block (after the size/error check). The added code verifies that $picture[\u0027tmp_name\u0027] is non-empty and passes is_uploaded_file(). If either condition fails, a generic \u0027File was not uploaded correctly\u0027 error is appended to $saveResult[\u0027errors\u0027] and the function returns early, before pathinfo, file_exists, mime_content_type, or exif_imagetype are ever called on the untrusted path.",
"patchTruncated": false,
"patches": [
{
"commit": "9a2a4acfe71eaacfe9305a89483d45772edf16b4",
"patchSha256": "0a64cbcd67009e5af0b74721071bfaf4a36c3cac59e13128eaae04545009886a",
"source": "https://github.com/MISP/MISP/commit/9a2a4acfe.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/9a2a4acfe.patch",
"subject": "fix: [security] Reject a forged upload path in the"
}
],
"source": "https://github.com/MISP/MISP/commit/9a2a4acfe.patch",
"subject": "fix: [security] Reject a forged upload path in the",
"tagVersionBoundary": {
"commits_after_fix": 49,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-200",
"rationale": "The primary security impact is the disclosure of filesystem state (file existence and type) through distinct error messages, which is a classic information exposure weakness. The attacker does not read file contents but learns metadata about arbitrary paths."
},
{
"cweId": "CWE-22",
"rationale": "The caller-supplied tmp_name was used as a filesystem path without restricting it to the upload directory. Although the impact here is information disclosure rather than full file read/write, the root cause is the lack of path restriction, making CWE-22 a contributing weakness."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20218"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-95693",
"datePublished": "2026-09-22T14:22:28.896Z",
"dateReserved": "2026-09-22T14:22:26.180Z",
"dateUpdated": "2026-09-22T15:09:48.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-95693",
"date": "2026-09-23",
"epss": "0.0051",
"percentile": "0.42531"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"modules": [
"EventReport"
],
"product": "MISP",
"programFiles": [
"app/Model/EventReport.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.\u00a0\n\nThis constitutes an information disclosure vulnerability: the server\u0027s filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.\u00a0\n\nThe vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host."
}
],
"id": "CVE-2026-95693",
"lastModified": "2026-09-22T16:18:23.200",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-95693",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:09:40.847048Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-22T15:17:27.443",
"references": [
{
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"url": "https://github.com/MISP/MISP/commit/9a2a4acfe"
}
],
"sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
},
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95693",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:09:40.847048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:09:44.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"EventReport"
],
"product": "MISP",
"programFiles": [
"app/Model/EventReport.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis constitutes an information disclosure vulnerability: the server\u0027s filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host.\u003c/p\u003e"
}
],
"value": "In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.\u00a0\n\nThis constitutes an information disclosure vulnerability: the server\u0027s filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.\u00a0\n\nThe vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host."
}
],
"impacts": [
{
"capecId": "CAPEC-177",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-177 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T14:22:28.896Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/9a2a4acfe"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration.\u003c/p\u003e"
}
],
"value": "The fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration."
}
],
"title": "MISP Information Disclosure via Forged Upload Path",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 49 commits after fix), suggesting versions prior to the fix commit are vulnerable. No explicit version range is stated in the patch.",
"PR:L is assumed because the commit message specifies \u0027any perm_add user\u0027, which is a non-admin role in MISP. The exact privilege level mapping to CVSS PR is an assumption.",
"VC:L is assigned because the disclosure is limited to file existence and type metadata, not full file contents. If the information disclosed is considered more sensitive in a specific deployment, VC could be rated higher.",
"CAPEC-177 (Path Traversal) is the closest available pattern; the actual impact is an information-disclosure oracle rather than a full traversal read, so the mapping is approximate.",
"The Co-Authored-By line credits an AI assistant (Claude Opus 4.8) as a remediation developer. This is recorded as supplied in the metadata but is atypical for CVE credit."
],
"capecRationale": [
{
"capecId": "CAPEC-177",
"rationale": "The attacker manipulates the tmp_name parameter to reference file paths outside the intended upload directory, causing the server to probe arbitrary locations. Although the observable effect is information disclosure rather than full file read, the mechanism is path traversal: the application uses an untrusted path string to access the filesystem. CAPEC-177 is the closest available pattern; the uncertainty is that the impact is limited to metadata disclosure rather than full traversal read, but no more specific CAPEC exists for \u0027path probing via error-message oracle\u0027."
}
],
"commit": "9a2a4acfe71eaacfe9305a89483d45772edf16b4",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: MISP is a web application accessed over the network. AC:L: The attack requires only crafting a request with a different tmp_name value; no race conditions or complex setup are needed. AT:N: No prior user interaction or attack complexity beyond the request is required. PR:L: The attacker needs an authenticated account with the perm_add permission, which is a low-privilege role in MISP (not admin). UI:N: No victim interaction is required. VC:L: File existence and type information is disclosed, but file contents are not readable. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: No impact on subsequent components.",
"fixSummary": "The fix introduces an early validation gate in EventReport::uploadPicture that checks is_uploaded_file() on the supplied tmp_name before any filesystem-probing functions (file_exists, mime_content_type, exif_imagetype) are invoked. If the value is not a genuine PHP upload, the method immediately returns a generic error message, preventing the attacker from using the endpoint as an oracle for filesystem enumeration.",
"generatedAt": "2026-09-22T14:16:43.440374Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "0a64cbcd67009e5af0b74721071bfaf4a36c3cac59e13128eaae04545009886a",
"patchSummary": "In app/Model/EventReport.php, eight lines are inserted at the top of the upload-processing block (after the size/error check). The added code verifies that $picture[\u0027tmp_name\u0027] is non-empty and passes is_uploaded_file(). If either condition fails, a generic \u0027File was not uploaded correctly\u0027 error is appended to $saveResult[\u0027errors\u0027] and the function returns early, before pathinfo, file_exists, mime_content_type, or exif_imagetype are ever called on the untrusted path.",
"patchTruncated": false,
"patches": [
{
"commit": "9a2a4acfe71eaacfe9305a89483d45772edf16b4",
"patchSha256": "0a64cbcd67009e5af0b74721071bfaf4a36c3cac59e13128eaae04545009886a",
"source": "https://github.com/MISP/MISP/commit/9a2a4acfe.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/9a2a4acfe.patch",
"subject": "fix: [security] Reject a forged upload path in the"
}
],
"source": "https://github.com/MISP/MISP/commit/9a2a4acfe.patch",
"subject": "fix: [security] Reject a forged upload path in the",
"tagVersionBoundary": {
"commits_after_fix": 49,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-200",
"rationale": "The primary security impact is the disclosure of filesystem state (file existence and type) through distinct error messages, which is a classic information exposure weakness. The attacker does not read file contents but learns metadata about arbitrary paths."
},
{
"cweId": "CWE-22",
"rationale": "The caller-supplied tmp_name was used as a filesystem path without restricting it to the upload directory. Although the impact here is information disclosure rather than full file read/write, the root cause is the lack of path restriction, making CWE-22 a contributing weakness."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20218"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-95693",
"datePublished": "2026-09-22T14:22:28.896Z",
"dateReserved": "2026-09-22T14:22:26.180Z",
"dateUpdated": "2026-09-22T15:09:48.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…