File and Path Handling

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.CVE-2024-29859Misp-Project · CVSS 9.8 · 0.8% likely

   CWE-434

2. An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.CVE-2024-25674Misp-Project · CVSS 9.8 · 0.8% likely

   CWE-434

3. MISP Path Traversal via Organization Name in Org-Statistics Logo CheckCVE-2026-95701MISP · CVSS 5.1 · 0.8% likely

   CWE-22

4. MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization NameCVE-2026-95698MISP · CVSS 5.3 · 0.7% likely

   CWE-22

5. Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix libraryCVE-2026-77751misp · CVSS 8.8 · 0.7% likely

   CWE-22

6. MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File ExtensionCVE-2026-94383MISP · CVSS 8.6 · 0.5% likely

   CWE-434

7. app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.CVE-2025-66386MISP · CVSS 4.1 · 0.3% likely

   CWE-23

8. MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG filesCVE-2026-54394misp · CVSS 5.3 · 0.3% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.