CVE-2026-95703 (GCVE-0-2026-95703)

Vulnerability from cvelistv5 – Published: 2026-09-22 14:49 – Updated: 2026-09-22 15:00
VLAI
Title
MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name
Summary
In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem. The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 14:59 UTC
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
MISP MISP Affected: 0 , < 2.5.47 (semver)
guessed Create a notification for this product.
Credits
iglocska Claude Opus 4.8
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-22 14:45
Model
qwen3.8:27b
Input
https://github.com/MISP/MISP/commit/12eaadc9e.patch 175abb34a19c…
Confidence
medium
Commit Subject Patch SHA-256
12eaadc9e28b fix: [organisation] Reject a forged upload path in the 175abb34a19c…
Fix summary

The is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle.

Patch summary

In app/Controller/OrganisationsController.php, six lines are inserted inside __uploadLogo() after the existing size/error check. The added block checks whether $logo['tmp_name'] is empty or fails is_uploaded_file(), and if so, returns false immediately. A comment explains that only a genuine PHP upload may reach the subsequent filesystem probes. No other logic is modified.

CVSS rationale

AV:N: exploited over the network via the MISP web interface. AC:L: the attack is a simple parameter substitution with no race or timing requirement. AT:N: no attack-target manipulation is needed. PR:H: the commit message explicitly states this is a site-admin-only issue. UI:N: no victim interaction beyond the admin's own request. VC:L: limited confidentiality impact — disclosure of file existence and image type on the server, but no file content is read. VI:N, VA:N: no integrity or availability impact. SC:N, SI:N, SA:N: no secondary-component impact.

Weakness rationale
  • CWE-200 The primary security impact is the disclosure of file existence and image type on the server through differential error messages, which constitutes sensitive information exposure to an authenticated (but not fully privileged) actor.
  • CWE-20 The root cause is that the caller-supplied tmp_name value was used in filesystem operations without first validating that it originated from a genuine PHP file upload (is_uploaded_file check was performed too late or not at all before the probes).
Attack pattern rationale
  • CAPEC-126 The attacker manipulates the tmp_name parameter of the upload form to point to an arbitrary server file path, causing the application to probe that path and leak information through its responses. This is the closest CAPEC pattern to the observed attack: tampering with a request parameter to trigger unintended server-side behavior. Uncertainty: no CAPEC pattern specifically covers file-existence oracles via forged upload paths, so CAPEC-126 is the best available match.
Assumptions to verify
  • The commit message states the issue is 'site-admin-only'; this is taken as the required privilege level (PR:H) without independent verification of MISP's role model.
  • The tag_version_boundary indicates v2.5.47 with 48 commits after the fix, suggesting the fix landed shortly after v2.5.47, but no explicit fixed version tag is provided; the affected range is therefore marked as less_than 2.5.47 with low confidence.
  • The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a file-existence oracle via forged upload parameters, so the mapping is approximate.
  • The commit message references a similar pattern in the event-report picture upload; whether that path was also fixed in this or a separate commit is not determined by this patch alone.
  • The 'found during the internal review' statement in the commit message is treated as a generic internal process note; no specific finder is credited because the metadata explicitly lists finders as empty.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 5 9 medium 5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:59:43.387710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:00:15.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "OrganisationsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/OrganisationsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.\u003c/p\u003e\u003cp\u003eThe vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.\n\nThe vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T14:49:42.588Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/12eaadc9e"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle.\u003c/p\u003e"
            }
          ],
          "value": "The is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle."
        }
      ],
      "title": "MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The commit message states the issue is \u0027site-admin-only\u0027; this is taken as the required privilege level (PR:H) without independent verification of MISP\u0027s role model.",
                  "The tag_version_boundary indicates v2.5.47 with 48 commits after the fix, suggesting the fix landed shortly after v2.5.47, but no explicit fixed version tag is provided; the affected range is therefore marked as less_than 2.5.47 with low confidence.",
                  "The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a file-existence oracle via forged upload parameters, so the mapping is approximate.",
                  "The commit message references a similar pattern in the event-report picture upload; whether that path was also fixed in this or a separate commit is not determined by this patch alone.",
                  "The \u0027found during the internal review\u0027 statement in the commit message is treated as a generic internal process note; no specific finder is credited because the metadata explicitly lists finders as empty."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker manipulates the tmp_name parameter of the upload form to point to an arbitrary server file path, causing the application to probe that path and leak information through its responses. This is the closest CAPEC pattern to the observed attack: tampering with a request parameter to trigger unintended server-side behavior. Uncertainty: no CAPEC pattern specifically covers file-existence oracles via forged upload paths, so CAPEC-126 is the best available match."
                  }
                ],
                "commit": "12eaadc9e28bdb7fc723faa2f006eaaa13c4ffdb",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: exploited over the network via the MISP web interface. AC:L: the attack is a simple parameter substitution with no race or timing requirement. AT:N: no attack-target manipulation is needed. PR:H: the commit message explicitly states this is a site-admin-only issue. UI:N: no victim interaction beyond the admin\u0027s own request. VC:L: limited confidentiality impact \u2014 disclosure of file existence and image type on the server, but no file content is read. VI:N, VA:N: no integrity or availability impact. SC:N, SI:N, SA:N: no secondary-component impact.",
                "fixSummary": "The is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle.",
                "generatedAt": "2026-09-22T14:45:44.315009Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "175abb34a19cd998d66ca5363124749b640d7b922547e5d3aff8bd4e4239dfa7",
                "patchSummary": "In app/Controller/OrganisationsController.php, six lines are inserted inside __uploadLogo() after the existing size/error check. The added block checks whether $logo[\u0027tmp_name\u0027] is empty or fails is_uploaded_file(), and if so, returns false immediately. A comment explains that only a genuine PHP upload may reach the subsequent filesystem probes. No other logic is modified.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "12eaadc9e28bdb7fc723faa2f006eaaa13c4ffdb",
                    "patchSha256": "175abb34a19cd998d66ca5363124749b640d7b922547e5d3aff8bd4e4239dfa7",
                    "source": "https://github.com/MISP/MISP/commit/12eaadc9e.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/12eaadc9e.patch",
                    "subject": "fix: [organisation] Reject a forged upload path in the"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/12eaadc9e.patch",
                "subject": "fix: [organisation] Reject a forged upload path in the",
                "tagVersionBoundary": {
                  "commits_after_fix": 48,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-200",
                    "rationale": "The primary security impact is the disclosure of file existence and image type on the server through differential error messages, which constitutes sensitive information exposure to an authenticated (but not fully privileged) actor."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is that the caller-supplied tmp_name value was used in filesystem operations without first validating that it originated from a genuine PHP file upload (is_uploaded_file check was performed too late or not at all before the probes)."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20270"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95703",
    "datePublished": "2026-09-22T14:49:42.588Z",
    "dateReserved": "2026-09-22T14:49:37.648Z",
    "dateUpdated": "2026-09-22T15:00:15.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-95703",
      "date": "2026-09-23",
      "epss": "0.00508",
      "percentile": "0.42436"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "modules": [
                  "OrganisationsController"
                ],
                "product": "MISP",
                "programFiles": [
                  "app/Controller/OrganisationsController.php"
                ],
                "repo": "https://github.com/MISP/MISP",
                "vendor": "MISP",
                "versions": [
                  {
                    "lessThan": "2.5.47",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.\n\nThe vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type."
          }
        ],
        "id": "CVE-2026-95703",
        "lastModified": "2026-09-22T16:18:23.977",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-95703",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T14:59:43.387710Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T15:17:28.323",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/MISP/MISP/commit/12eaadc9e"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.