CVE-2026-54394
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo
Published: 2026-06-12 · Last updated: 2026-06-12
Severity and scoring
- CWE
- CWE-22
Description
MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
Source: NVD
References
Related CVEs
Same CWE
- CVE-2026-12089 — The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, an... (4.9 MEDIUM)
- CVE-2026-11442 — Allegra exportReport Directory Traversal Information Disclosure Vulnerability (6.5 MEDIUM)
- CVE-2026-53825 — OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gatewa... (6.5 MEDIUM)
- CVE-2026-53519 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool (9.1 CRITICAL)
- CVE-2026-45775 — Discourse is an open-source discussion platform (6.8 MEDIUM)