CVE-2026-95667

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47

Description Installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp install.log and a named pipe (FIFO) at /var/log/misp install.log.pipe to capture output. These files contain sensitive information, including the generated admin password, database passwords, GPG passphrase, and supervisor password. Because the log file is created using the tee command and the FIFO is created via mkfifo without explicit modes, both inherit the system default umask, making them world-readable. This allows any local unprivileged user to read the credentials. Furthermore, the installer does not remove the log file before creation, which could allow a pre-existing symlink in /var/log to redirect writes to an arbitrary location.

Recommendations Update to version 2.5.47 or later.