Executive brief
A security flaw in the MISP threat intelligence platform's dashboard allows attackers to create buttons that appear to link to internal pages but actually redirect users to external, malicious websites. This could be used to trick security analysts into visiting phishing sites or providing credentials to an attacker. The issue stems from how the software validates web addresses within its dashboard widgets.
Technical details
An open redirect (CWE-601) exists in the MISP dashboard button widget due to insufficient URL validation. While the application attempts to block external URLs by rejecting those with explicit schemes or hosts, it fails to account for paths starting with a slash followed by a backslash (e.g., '/\example.com'). Many modern browsers normalize the backslash into a forward slash, treating the string as a scheme-relative URL and navigating to the external domain. An attacker with dashboard configuration privileges can exploit this to facilitate phishing or social engineering. The vulnerability was addressed by updating the validation logic to reject empty paths and the '/\' prefix, and ensuring only the reconstructed, validated URL is used in the anchor href.
Affected products
- MISP Project MISP Prior to commit f879f16fb5db7a9aab0a70fdcafea12ce4847e9a
Timeline
- 2026-06-04: advisory: NVD publication date
- 2026-06-04: disclosed: CVE record published