Executive brief
MISP, a threat intelligence platform, contained a flaw in its organisation logo upload feature that allowed site administrators to discover whether arbitrary files exist on the server and determine the type of image files. An attacker with site-admin privileges could probe the filesystem by submitting crafted file paths and observing distinct error messages to infer the existence and properties of files.
Technical details
The OrganisationsController::__uploadLogo method performed filesystem probes (file_exists, MIME type detection, EXIF reading) on a caller-supplied tmp_name parameter before validating it against is_uploaded_file, creating an information disclosure oracle. This affects only authenticated site-admin users and does not enable file read, code execution, or file modification. The vulnerability was discovered during internal review and patched by hoisting the is_uploaded_file validation before any filesystem operations.
Affected products
- MISP MISP
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fix applied in commit 12eaadc