Executive brief
MISP is an open-source threat intelligence platform used by security teams to share and analyze malware, indicators of compromise, and other threat data. A path traversal vulnerability in the STIX 2 import/export functionality could allow an attacker to read or manipulate sensitive files on the server by crafting malicious object names, potentially exposing locally accessible data or modifying threat intelligence objects with unintended metadata.
Technical details
This is a path traversal vulnerability (CWE-22) in MISP's object template resolution mechanism used during STIX 2 import and export. The vulnerability arises because object template names from untrusted STIX or MISP content are not properly validated before being used to construct filesystem paths. An attacker can supply a crafted object name containing path traversal sequences (e.g., ../) to escape the intended template directory and load definition.json files from arbitrary locations. Attack preconditions include the ability to supply crafted STIX content during import or inject malicious object names into stored MISP events (which can be processed later during export with elevated privileges). The impact ranges from information disclosure (reading locally accessible files) to object metadata manipulation. Patches implement strict allowlist-based validation restricting object names to a single path component with alphanumeric, hyphen, and underscore characters only.
Affected products
- MISP Project MISP
Timeline
- 2026-08-21: disclosed