CVE-2026-95693

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

CVE-2026-95693

MISP 's EventReport::uploadPicture method processes a caller-supplied tmp_name field by calling file_exists(), mime_content_type(), and exif_imagetype() on the path before validating it with is_uploaded_file(). An authenticated user with the perm_add permission can supply an arbitrary filesystem ...

CVE-2026-95693 MISP Information Disclosure via Forged Upload Path

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

CVE-2026-95693 MISP Information Disclosure via Forged Upload Path

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

CVE-2026-95693 MISP Information Disclosure via Forged Upload Path

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

EUVD-2026-84492

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

PT-2026-96767

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp name field by invoking file exists, mime content type, and exif imagetype on the supplied path before verifying that the value was a genuine PHP upload via is uploaded file. An authenticated user holding the perm ad...

CVE-2026-95693: Exposure of Sensitive Information to an Unauthorized Actor

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...