Executive brief
MISP, an open-source threat intelligence platform, contains a security flaw in how it handles organization logos. An attacker with basic user permissions could manipulate organization settings to access and view unauthorized image files (PNG or SVG) stored on the server. This could lead to the exposure of sensitive system information or internal assets that should not be publicly accessible.
Technical details
A path traversal vulnerability exists in the `OrganisationsController::getOrgLogo` function of MISP. The application constructs file paths for organization logos using user-controlled fields such as 'id', 'name', and 'uuid' without proper sanitization or validation against the base directory `APP/files/img/orgs/`. By injecting path traversal sequences (e.g., ../) into these fields, an authenticated attacker can bypass directory restrictions to read arbitrary .png or .svg files accessible to the web server process. The vulnerability is mitigated by implementing `realpath()` validation to ensure the resolved path remains within the intended directory.
Affected products
- MISP Project MISP Prior to commit b865deb
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory