In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.
The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.
"}],"value":"In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.\n\nThe vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Parameter Tampering"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T14:49:42.588Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/12eaadc9e"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle.
"}],"value":"The is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle."}],"title":"MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_name","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The commit message states the issue is 'site-admin-only'; this is taken as the required privilege level (PR:H) without independent verification of MISP's role model.","The tag_version_boundary indicates v2.5.47 with 48 commits after the fix, suggesting the fix landed shortly after v2.5.47, but no explicit fixed version tag is provided; the affected range is therefore marked as less_than 2.5.47 with low confidence.","The CAPEC-126 mapping is the closest available pattern; no CAPEC specifically describes a file-existence oracle via forged upload parameters, so the mapping is approximate.","The commit message references a similar pattern in the event-report picture upload; whether that path was also fixed in this or a separate commit is not determined by this patch alone.","The 'found during the internal review' statement in the commit message is treated as a generic internal process note; no specific finder is credited because the metadata explicitly lists finders as empty."],"capecRationale":[{"capecId":"CAPEC-126","rationale":"The attacker manipulates the tmp_name parameter of the upload form to point to an arbitrary server file path, causing the application to probe that path and leak information through its responses. This is the closest CAPEC pattern to the observed attack: tampering with a request parameter to trigger unintended server-side behavior. Uncertainty: no CAPEC pattern specifically covers file-existence oracles via forged upload paths, so CAPEC-126 is the best available match."}],"commit":"12eaadc9e28bdb7fc723faa2f006eaaa13c4ffdb","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 4.8"}],"cvssRationale":"AV:N: exploited over the network via the MISP web interface. AC:L: the attack is a simple parameter substitution with no race or timing requirement. AT:N: no attack-target manipulation is needed. PR:H: the commit message explicitly states this is a site-admin-only issue. UI:N: no victim interaction beyond the admin's own request. VC:L: limited confidentiality impact — disclosure of file existence and image type on the server, but no file content is read. VI:N, VA:N: no integrity or availability impact. SC:N, SI:N, SA:N: no secondary-component impact.","fixSummary":"The is_uploaded_file() guard is hoisted to execute immediately after the basic size/error check and before any filesystem probe (file_exists, MIME detection, EXIF reading). If the tmp_name is empty or does not correspond to a genuine PHP upload, the method returns false early, preventing any filesystem interaction with an attacker-controlled path and eliminating the information oracle.","generatedAt":"2026-09-22T14:45:44.315009Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"medium","model":"qwen3.8:27b","score":5}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"175abb34a19cd998d66ca5363124749b640d7b922547e5d3aff8bd4e4239dfa7","patchSummary":"In app/Controller/OrganisationsController.php, six lines are inserted inside __uploadLogo() after the existing size/error check. The added block checks whether $logo['tmp_name'] is empty or fails is_uploaded_file(), and if so, returns false immediately. A comment explains that only a genuine PHP upload may reach the subsequent filesystem probes. No other logic is modified.","patchTruncated":false,"patches":[{"commit":"12eaadc9e28bdb7fc723faa2f006eaaa13c4ffdb","patchSha256":"175abb34a19cd998d66ca5363124749b640d7b922547e5d3aff8bd4e4239dfa7","source":"https://github.com/MISP/MISP/commit/12eaadc9e.patch","sourceUrl":"https://github.com/MISP/MISP/commit/12eaadc9e.patch","subject":"fix: [organisation] Reject a forged upload path in the"}],"source":"https://github.com/MISP/MISP/commit/12eaadc9e.patch","subject":"fix: [organisation] Reject a forged upload path in the","tagVersionBoundary":{"commits_after_fix":48,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-200","rationale":"The primary security impact is the disclosure of file existence and image type on the server through differential error messages, which constitutes sensitive information exposure to an authenticated (but not fully privileged) actor."},{"cweId":"CWE-20","rationale":"The root cause is that the caller-supplied tmp_name value was used in filesystem operations without first validating that it originated from a genuine PHP file upload (is_uploaded_file check was performed too late or not at all before the probes)."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20270"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95703","datePublished":"2026-09-22T14:49:42.588Z","dateReserved":"2026-09-22T14:49:37.648Z","dateUpdated":"2026-09-22T15:00:15.086Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 15:17:28","lastModifiedDate":"2026-09-22 16:18:23","problem_types":["CWE-20","CWE-200","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T14:59:43.387710Z","id":"CVE-2026-95703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95703","Ordinal":"1","Title":"MISP OrganisationsController File Existence and Image-Type Oracl","CVE":"CVE-2026-95703","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95703","Ordinal":"1","NoteData":"In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is_uploaded_file. An authenticated site-admin user could supply an arbitrary server file path as the tmp_name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.\n\nThe vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.","Type":"Description","Title":"MISP OrganisationsController File Existence and Image-Type Oracl"}]}}}