Vulnerability-Lookup

FKIE_CVE-2026-94383

Vulnerability from fkie_nvd - Published: 2026-09-21 13:17 - Updated: 2026-09-21 15:17

Severity

8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process. The vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server's confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user. Version affected: <2.5.47

References

	URL	Tags
	5a6e4751-2f3f-4070-9419-94fb35b644e8	https://github.com/MISP/MISP/commit/e5a943178

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "modules": [
            "WorkflowModules/action/Module_blocklist_action"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/action/Module_blocklist_action.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\n\nThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\n\nVersion affected: \u003c2.5.47"
    }
  ],
  "id": "CVE-2026-94383",
  "lastModified": "2026-09-21T15:17:39.433",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-94383",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-21T14:37:12.233579Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-21T13:17:13.560",
  "references": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "url": "https://github.com/MISP/MISP/commit/e5a943178"
    }
  ],
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary"
    }
  ]
}

CVE-2026-94383 (GCVE-0-2026-94383)

Vulnerability from cvelistv5 – Published: 2026-09-21 12:52 – Updated: 2026-09-21 14:48

Title

MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

Summary

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 14:37 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-20 - Improper Input Validation

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 91/100 over 254 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/e5a943178	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.47 (semver)

Credits

Jeroen Pinoy iglocska

GCVE extensions

AI-generated Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

bcp-05-x-01

AI-assisted vulnerability information annotation

GCVE-BCP-05-X-01

Whole record AI-generated Review: review GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

bcp-05-x-02

Patch-to-vulnerability generation provenance

GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-21 12:44
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/e5a943178.patch 9b7cc757cbbc…
Confidence: medium

Commit	Subject	Patch SHA-256
`e5a9431784b4`	fix: [security] arbitrary script execution via insufficient	`9b7cc757cbbc…`

Fix summary

The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.

Patch summary

In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing 'txt', 'list', 'blocklist', and 'csv', extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message 'Blocklist filename has an invalid extension.' This check is placed before the existing empty/dot filename validation.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states 'site admin only', requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.

Weakness rationale

CWE-434 The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434.
CWE-20 The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue.

Attack pattern rationale

CAPEC-170 CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate.

Assumptions to verify

The commit message states 'site admin only', which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.
The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject 'arbitrary script execution'. The patch does not include web server configuration evidence.
The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.
CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.
The CVSS PR:H rating assumes that 'site admin' in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP's role model.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	5	9	medium	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T14:37:12.233579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:48:17.369Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "WorkflowModules/action/Module_blocklist_action"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Model/WorkflowModules/action/Module_blocklist_action.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
            }
          ],
          "value": "The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\n\nThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\n\nVersion affected: \u003c2.5.47"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-170",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-170 File Upload"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T12:52:03.355Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/e5a943178"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.\u003c/p\u003e"
            }
          ],
          "value": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server."
        }
      ],
      "title": "MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "review",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states \u0027site admin only\u0027, which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.",
                  "The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject \u0027arbitrary script execution\u0027. The patch does not include web server configuration evidence.",
                  "The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.",
                  "CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.",
                  "The CVSS PR:H rating assumes that \u0027site admin\u0027 in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP\u0027s role model."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-170",
                    "rationale": "CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate."
                  }
                ],
                "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states \u0027site admin only\u0027, requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.",
                "fixSummary": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.",
                "generatedAt": "2026-09-21T12:44:28.234229Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                "patchSummary": "In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing \u0027txt\u0027, \u0027list\u0027, \u0027blocklist\u0027, and \u0027csv\u0027, extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message \u0027Blocklist filename has an invalid extension.\u0027 This check is placed before the existing empty/dot filename validation.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
                    "patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
                    "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                    "subject": "fix: [security] arbitrary script execution via insufficient"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
                "subject": "fix: [security] arbitrary script execution via insufficient",
                "tagVersionBoundary": {
                  "commits_after_fix": 142,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-434",
                    "rationale": "The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20009"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-94383",
    "datePublished": "2026-09-21T12:52:03.355Z",
    "dateReserved": "2026-09-21T12:52:01.101Z",
    "dateUpdated": "2026-09-21T14:48:17.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted