# CVE-2026-95701: MISP path traversal in organization logo check

Source: https://junglewise.ai/threats/cve-2026-95701-in-misp-the-statisticsorgs-method-in-userscontroller-php-used-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95701 · Severity: info · Published 2026-09-22

MISP, a threat intelligence sharing platform, contained a path traversal weakness in how it validated organization logo images. An authenticated user with permission to create or rename organizations could use specially crafted names containing directory traversal sequences to probe for the existence of arbitrary files on the server. While the vulnerable code path was functionally inactive due to a directory relocation, the pattern itself represents a security gap that could have enabled information disclosure.

Technologies: [MISP Project MISP](https://junglewise.ai/threats/technologies/misp-project-misp). Vendors: [MISP Project](https://junglewise.ai/threats/vendors/misp-project).

## Quick answers

**Is CVE-2026-95701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95701 being exploited in the wild.

**How severe is CVE-2026-95701?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** MISP Project MISP.

**Is there a fix for CVE-2026-95701?** A patch was published on 2026-09-22: Fix merges realpath validation and directory path correction Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95701 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95701?** Check whether you run MISP Project MISP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The __statisticsOrgs method in UsersController.php concatenated the organization name ($k) directly into a file_exists() check without sanitization: APP . 'webroot/img/orgs/' . $k . '.png'. An organization name containing sequences like '../../../../etc/passwd' would allow path traversal if the target directory existed. The check was effectively dead because organization logos were relocated to files/img/orgs, but the underlying anti-pattern—unsanitized path concatenation—constitutes a vulnerability. The fix adds realpath prefix validation to prevent directory traversal while also updating the check to reference the correct live directory.

## Affected products

- MISP Project MISP

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: Fix merges realpath validation and directory path correction

## References

- [https://github.com/MISP/MISP/commit/a2f7cba6e](https://github.com/MISP/MISP/commit/a2f7cba6e)

## Related threats

- [MISP module plugin settings flags not preserved](https://junglewise.ai/threats/cve-2026-112192-misp-contains-a-vulnerability-in-the-handling-of-module-plugin)
- [MISP server settings information disclosure](https://junglewise.ai/threats/cve-2026-112188-misp-contains-a-vulnerability-in-its-server-settings-lookup)
- [MISP reflected XSS in workflow module interface](https://junglewise.ai/threats/cve-2026-112184-misp-contains-a-reflected-cross-site-scripting-xss-vulnerability)
- [MISP data integrity flaw in event deletion logic](https://junglewise.ai/threats/cve-2026-112180-misp-contains-a-data-integrity-flaw-in-its-event-deletion-logic)
- [MISP event synchronization information disclosure via tag filtering](https://junglewise.ai/threats/cve-2026-112179-in-misp-the-event-synchronization-process-contained-a-logic)