CVE-2026-54393

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A stored cross-site scripting issue exists when using the Overmind theme. The 'setHomePage' endpoint saves the user-controlled path value via the setSettingInternal() function, which bypasses the setSetting() validation logic and the validate homepage check that requires paths to start with /. This allows an authenticated user to store an arbitrary value, such as a malicious script. The value is subsequently rendered in 'app/View/News/index.ctp' as the href attribute of the “Continue to homepage” link without HTML escaping, enabling the execution of attacker-controlled JavaScript in the browser context of the affected instance.

Recommendations Update the software to a version where the homepage setting is persisted through setSetting() to ensure validation and access checks are applied, and where the homepage value is HTML-escaped before rendering in the news view.