Executive brief
MISP, a threat intelligence sharing platform, contained a path traversal weakness in how it validated organization logo images. An authenticated user with permission to create or rename organizations could use specially crafted names containing directory traversal sequences to probe for the existence of arbitrary files on the server. While the vulnerable code path was functionally inactive due to a directory relocation, the pattern itself represents a security gap that could have enabled information disclosure.
Technical details
The __statisticsOrgs method in UsersController.php concatenated the organization name ($k) directly into a file_exists() check without sanitization: APP . 'webroot/img/orgs/' . $k . '.png'. An organization name containing sequences like '../../../../etc/passwd' would allow path traversal if the target directory existed. The check was effectively dead because organization logos were relocated to files/img/orgs, but the underlying anti-pattern—unsanitized path concatenation—constitutes a vulnerability. The fix adds realpath prefix validation to prevent directory traversal while also updating the check to reference the correct live directory.
Affected products
- MISP Project MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fix merges realpath validation and directory path correction