CVE-2026-103664

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.48

Description A reflected cross-site scripting (XSS) issue exists in the analyst data notes panel. The seed path parameter, provided by the user via the URL, is passed directly into inline JavaScript within the HTML response without sanitization or type enforcement. An attacker can convince an authenticated user to visit a crafted URL, allowing the execution of arbitrary JavaScript in the victim's browser context. This could lead to the theft of session tokens, page manipulation, or unauthorized actions performed on behalf of the user.

Recommendations Update MISP to version 2.5.48 or later.