PT-2026-103287

CVE-2026-103388

Published

2026-09-30

Updated

2026-09-30

Description by

CVSS 4.0

6.2

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description Stored cross-site scripting (XSS) occurs because the source field of a Galaxy Cluster is rendered as a clickable hyperlink if the value passes PHP's FILTER VALIDATE URL validation. Since this validation accepts the javascript: URI scheme, a user with galaxy editor privileges can store a malicious script as the cluster source. When another user clicks the link, the script executes in their browser context, potentially leading to session hijacking, data exfiltration, or unauthorized actions.

Recommendations Update to version 2.5.48 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Iglocska

Jeroen Pinoy

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')