CVE-2026-94401

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94401

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94401.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94401

Published

2026-09-21T13:36:13Z

Modified

2026-09-23T03:47:29Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

MISP Arbitrary Local File Read and SSRF via MISP Export Upload

Details

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.

When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.

If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.

The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.

Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.

Version affected: <2.5.47

Database specific

{
    "cna_assigner":  "CIRCL",
    "cwe_ids":  [
        "CWE-73",
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94401.json"
}

References

Affected packages

Git / github.com/misp/misp

Affected ranges

Type

GIT

Repo

https://github.com/misp/misp

Events

Introduced

Fixed

d5f247b91

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.5.47"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94401.json"