CVE-2026-86347 MISP CVE debrief

Who should care

Defenders responsible for MISP deployments should assess exposure and verify version numbers to ensure the patch is applied. They should also restrict upload permissions to authorized users and monitor server disk space for unusual consumption patterns. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-86347 allows low-privileged users in MISP to upload files without proper restrictions, potentially consuming server disk space. Defenders should verify MISP versions and restrict upload permissions.

• Potential for low-privileged users to consume server disk space
• Need for defenders to verify MISP version and restrict upload permissions

Technical summary

The vulnerability in MISP allows low-privileged users to upload files without proper restrictions due to a misconfigured ACL entry. The issue has been fixed by changing the ACL requirement from '*' to 'perm_add'. The vulnerability can be exploited by low-privileged or read-only users, who can repeatedly upload files and consume server disk space without requiring perm_add or perm_template. The commit also rules out stronger impacts: uploaded files receive random names, path traversal/predictable overwrite is not available, the temporary directory is outside the web root, and the files are not directly served over HTTP.

Defensive priority

Defenders should prioritize verifying MISP versions and restricting upload permissions.

Recommended defensive actions

• Verify MISP version and apply patch if necessary
• Restrict upload permissions to authorized users
• Monitor server disk space for unusual consumption patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its impact and fix. A commit from the MISP repository further explains the issue and the applied fix. The vulnerability allows low-privileged users to upload files without proper restrictions, potentially consuming server disk space. The issue arises from a misconfigured ACL entry for templates/uploadFile, which was set to '*' instead of 'perm_add'. The fix changes the ACL requirement from '*' to 'perm_add'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.