CVE-2026-54394

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A path traversal issue exists in the getOrgLogo() function of the OrganisationsController. The software constructs file paths for organization logos using fields controlled by the organization, such as id, name, and uuid, without verifying that the resulting path stays within the intended APP/files/img/orgs/ directory. An attacker who can modify an organization field, such as the organization name, can use path traversal sequences to retrieve arbitrary readable .png or .svg files from locations outside the designated logo directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.