Executive brief
MISP is an open-source threat intelligence platform that allows organizations to upload and share security information. The platform was serving uploaded SVG image files (such as organization logos and report pictures) inline to users' browsers without proper security restrictions. Because SVG files are XML-based documents that can contain executable scripts, an attacker could upload a malicious SVG file that executes arbitrary code in the context of other users' MISP sessions, potentially stealing sensitive data or performing actions on their behalf.
Technical details
This is a stored cross-site scripting (XSS) vulnerability affecting how MISP serves SVG files. While SVG files embedded via <img> tags do not execute embedded scripts, SVG files served inline as documents or via direct navigation allow <script> elements, event handlers, and javascript: URLs to execute with the privileges of the MISP origin and the viewer's session. The vulnerability exists in the file-serving path where SVG organization logos and event-report pictures are rendered inline. The patch adds a sandboxing mechanism via a `sandboxInlineFile()` function to restrict the execution context. SVG files uploaded while SVG support was enabled remain exploitable even after SVG uploads are disabled, as the vulnerability is in the serve path rather than upload validation.
Affected products
- MISP MISP ≤2.5.45
Timeline
- 2026-09-14: disclosed: CVE-2026-90957 published
- 2026-09-02: patched: Security fix committed to repository