Vulnerability Description
The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory. This yields two security impacts: - an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access. - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user. The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-95698?
CVE-2026-95698 is a documented vulnerability. The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_...
How severe is CVE-2026-95698?
CVSS scoring is not yet available for CVE-2026-95698. Check NVD for updates.
Is there a patch for CVE-2026-95698?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.