CVE-2026-95703

In MISP, the OrganisationsController:: uploadLogo method processed a caller-supplied tmp name value with filesystem probes (file exists, MIME type detection, EXIF reading) before verifying that the value corresponded to a genuine PHP file upload via is uploaded file. An authenticated site-admin user could supply an arbitrary server file path as the tmp name parameter. The application would then probe that path and return distinct validation error messages depending on whether the file existed and what its image type was, effectively creating a file-existence and image-type oracle against the server filesystem.

The vulnerability requires site-admin privileges and does not allow arbitrary file read, code execution, or modification; the impact is limited to disclosure of whether a given path exists on the server and, for image files, their type.