Veille CVE

‹ Retour à la liste

CVE-2026-54394

5.3 Moyenne

Publiée le 12/06/2026 à 23:16 · Modifiée le 17/06/2026 à 12:58 · Analyse NVD reportée · Source : 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 5.3 Moyenne 5a6e4751-2f3f-4070-9419-94fb35b644e8 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

Faiblesses (CWE)

Références

Ailleurs