8 matches found
CVE-2026-94383
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...
EUVD-2026-83908
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...
CVE-2026-94383
MISP versions prior to 2.5.47 are affected by an arbitrary code execution vulnerability in the blocklist workflow module . The module accepted a user-supplied blocklist filename parameter without validating the file extension, applying only basename() to strip path components and a check for empt...
CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...
CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...
CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...
PT-2026-96096
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...
CVE-2026-94383: Unrestricted Upload of File with Dangerous Type
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...