PatchSiren cyber security CVE debrief
CVE-2026-54394 misp CVE debrief
CVE-2026-54394 is a path traversal vulnerability in MISP's OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
- Vendor
- misp
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-12
- Original CVE updated
- 2026-06-12
- Advisory published
- 2026-06-12
- Advisory updated
- 2026-06-12
Who should care
Users of MISP
Technical summary
The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green.
Defensive priority
MEDIUM
Recommended defensive actions
- Apply the fix by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
- Refer to [ref-4] for the fix.
Evidence notes
The vulnerability is described in the CVE record [cve-org] and detailed in the NVD entry [nvd].
Official resources
-
CVE-2026-54394 CVE record
CVE.org
-
CVE-2026-54394 NVD detail
NVD
-
Source item URL
nvd_modified
-
Source reference
5a6e4751-2f3f-4070-9419-94fb35b644e8
CVE-2026-54394 was published on 2026-06-12T21:16:25.157Z and has not been modified since then.