Executive brief
MISP's blocklist workflow module failed to validate file extensions for user-supplied filenames, allowing a site administrator to upload files with arbitrary extensions to the export directory. If the web server is configured to execute scripts in that directory, an attacker with admin privileges could achieve remote code execution with the privileges of the web server process, fully compromising the MISP server.
Technical details
The blocklist workflow module accepted unsanitized filename parameters with only basename() filtering and empty/dot checks, failing to validate file extensions. An authenticated site administrator can trigger the workflow with a crafted filename containing a script extension (e.g., .php), placing an executable file in the web-accessible export directory. This leads to arbitrary code execution if the web server is configured to interpret scripts in that location.
Affected products
- MISP Project MISP before 2.5.47
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched