CVE-2026-103389

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A stored cross-site scripting (XSS) issue exists in the galaxy icon handling path. The icon field of a galaxy object is stored without server-side validation via the galaxy add, edit, and sync/import capture endpoints. This stored value is then directly concatenated into HTML markup by D3-based correlation graph rendering scripts in both the default and Overmind themes using the .html() method. A user with perm galaxy editor permissions can inject arbitrary HTML or JavaScript into the icon field, which executes in the browser session of any user viewing the correlation graph of an event containing a cluster from that galaxy. This can lead to session credential theft, data manipulation, or unauthorized actions performed on behalf of the victim.

Recommendations Update to version 2.5.48 or later.