https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 15:11:21 +0000 https://db.gcve.eu/vuln/cve-2026-95698 <p><strong>Affected:</strong> MISP</p> <p>The findOrgImage method in MISP&#39;s OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory.</p> <p>This yields two security impacts:</p> <p>- an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access.  - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.</p> <p>The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.</p> <p><strong>Affected:</strong> MISP</p> <p>The findOrgImage method in MISP&#39;s OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file_exists() on the resulting path. The organization name field is attacker-controllable through event import, which sets Org.name. Because no validation was performed on the field value before path construction, an organization name containing directory traversal sequences (e.g., ../../etc/passwd) would cause the path to resolve outside the intended org-image directory.</p> <p>This yields two security impacts:</p> <p>- an arbitrary file existence oracle, since file_exists() returns a boolean for any path the process can access.  - an arbitrary file read limited to files with .png or .svg extensions, because the resolved filename is returned and subsequently rendered or served to the requesting user.</p> <p>The vulnerability requires an authenticated user with the ability to create or import events that set the organization name.</p> https://db.gcve.eu/vuln/cve-2026-95698