PatchSiren cyber security CVE debrief

CVE-2026-54394 misp CVE debrief

CVE-2026-54394 is a path traversal vulnerability in MISP's OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields such as id, name, and uuid without ensuring that the resolved file remains inside the intended APP/files/img/orgs/ directory. An attacker able to influence an organisation field, for example the organisation name, could use path traversal sequences to cause MISP to return arbitrary readable .png or .svg files from outside the organisation logo directory. The issue is fixed by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.

Vendor: misp
Product: Unknown
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-12
Original CVE updated: 2026-06-15
Advisory published: 2026-06-12
Advisory updated: 2026-06-15

Who should care

Users of MISP

Technical summary

The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green.

Defensive priority

MEDIUM

Recommended defensive actions

Apply the fix by resolving candidate paths with realpath() and verifying that they remain under the expected base directory before serving the file.
Refer to [ref-4] for the fix.

Evidence notes

The vulnerability is described in the CVE record [cve-org] and detailed in the NVD entry [nvd].

Sources and references

Verified primary and authoritative sources

CVE-2026-54394 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-54394

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-54394 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54394

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/MISP/MISP/commit/b865deb036ca82dab272be260798f562034ba9ae

5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.