CVE-2026-95698 MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists on the resulting path. The organization name field is attacker-controllable through event...

CVE-2026-95698

MISP's OrgImgHelper::findOrgImage method builds a filesystem path by concatenating a user-supplied organization name (settable via event import) with a fixed image directory and extension, then calls file_exists() on the result. Because no validation is performed before path construction, an atta...