https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 07:33:56 +0000 https://db.gcve.eu/vuln/cve-2026-94401 <p><strong>Affected:</strong> MISP</p> <p>MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.</p> <p>When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.</p> <p>If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.</p> <p>The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.</p> <p>Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.</p> <p>Version affected: &lt;2.5.47</p> <p><strong>Affected:</strong> MISP</p> <p>MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.</p> <p>When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.</p> <p>If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.</p> <p>The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.</p> <p>Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.</p> <p>Version affected: &lt;2.5.47</p> https://db.gcve.eu/vuln/cve-2026-94401