{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90957", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-14T13:02:53.577Z", "datePublished": "2026-09-14T13:03:01.748Z", "dateUpdated": "2026-09-14T13:58:30.297Z"}, "containers": {"cna": {"affected": [{"modules": ["RestResponseComponent (sendFile / sandboxInlineFile)", "OrganisationsController (getOrgLogo)", "Server model (enable_svg_logos setting)"], "product": "MISP", "programFiles": ["app/Controller/Component/RestResponseComponent.php", "app/Controller/OrganisationsController.php", "app/Model/Server.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.46", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Scottish Government - National Cyber Team"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.</p>\n<p>The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <code>&lt;img&gt;</code>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <code>&lt;script&gt;</code> elements, event handlers, or <code>javascript:</code> URLs execute on the MISP origin with the viewer\u2019s session.</p>\n<p>The affected use cases include:</p><p></p>\u2003- organisation SVG logos;<br><div>\u2003-&nbsp;event-report SVG pictures.</div><div><br></div><p></p><p>Importantly, the vulnerable behavior is on the <strong>serve path</strong>, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.</p><p></p><p>Version affected: \u22642.5.45<br></p>"}], "value": "Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.\n\n\nThe commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <img>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <script> elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer\u2019s session.\n\n\nThe affected use cases include:\n\n\n\n\u2003- organisation SVG logos;\n\u2003-\u00a0event-report SVG pictures.\n\n\n\n\n\n\nImportantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.\n\n\n\nVersion affected: \u22642.5.45"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input in Web Page ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-14T13:03:01.748Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/MISP/commit/86496aecc"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A new sandboxInlineFile() method is added to RestResponseComponent. When a file is served inline (download=false) and its type is SVG (svg, svgz, or image/svg+xml), the response is augmented with a Content-Security-Policy header containing the sandbox directive (which assigns an opaque origin and disables script execution, plugins, and form submission) along with restrictive default-src, style-src, img-src, and font-src directives that still permit rendering of inline styles, embedded raster images, and data: fonts. An X-Content-Type-Options: nosniff header is also set. The method is invoked from both the generic sendFile() path and the org-logo endpoint. The enable_svg_logos setting description is updated to warn administrators that SVG files remain XML documents and should be left disabled unless required.</p>"}], "value": "A new sandboxInlineFile() method is added to RestResponseComponent. When a file is served inline (download=false) and its type is SVG (svg, svgz, or image/svg+xml), the response is augmented with a Content-Security-Policy header containing the sandbox directive (which assigns an opaque origin and disables script execution, plugins, and form submission) along with restrictive default-src, style-src, img-src, and font-src directives that still permit rendering of inline styles, embedded raster images, and data: fonts. An X-Content-Type-Options: nosniff header is also set. The method is invoked from both the generic sendFile() path and the org-logo endpoint. The enable_svg_logos setting description is updated to warn administrators that SVG files remain XML documents and should be left disabled unless required."}], "title": "MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "review", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The enable_svg_logos setting must be enabled (or was previously enabled and SVG files were uploaded) for the vulnerability to be exploitable; the default value is false.", "The attacker requires an authenticated MISP account with sufficient privileges to upload an organisation logo or attach a report picture.", "The victim must be an authenticated MISP user whose session is active in the browser when the SVG is loaded as a document.", "The fix is included in MISP v2.5.46 based on the tag boundary metadata (186 commits after the fix commit up to that tag); the exact version in which the vulnerability was introduced is not specified in the patch.", "CVSS UI:P assumes the primary exploitation path requires the victim to navigate to the SVG URL or have it embedded in an object/iframe; if an attacker can embed the SVG in a page the victim is already viewing without additional interaction, UI:N would apply."], "commit": "86496aecc35565c121820b8e60eac9508a516eb3", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Scottish Government - National Cyber Team"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "cvssRationale": "AV:N: The malicious SVG is delivered over HTTP/HTTPS to the victim's browser. AC:L: No race conditions or special network conditions are required; the SVG is already stored and served by the application. AT:N: No specific attack requirements beyond the SVG being present in the MISP instance. PR:L: The attacker needs an authenticated MISP account with permission to upload an organisation logo or attach a report picture. UI:P: The victim must navigate to the SVG URL or have it loaded in an <object>/<iframe> context; it does not execute when rendered via <img>. VC/VI/VA:N: The MISP server itself is not compromised; the impact is on the client-side session. SC:H: The attacker gains full read access to the victim's MISP session (threat intelligence, events, users, settings). SI:H: The attacker can perform write operations (create/modify/delete events, change settings) as the victim. SA:N: No availability impact on the victim's browser or the MISP instance.", "draft": false, "fixSummary": "A new sandboxInlineFile() method is added to RestResponseComponent. When a file is served inline (download=false) and its type is SVG (svg, svgz, or image/svg+xml), the response is augmented with a Content-Security-Policy header containing the sandbox directive (which assigns an opaque origin and disables script execution, plugins, and form submission) along with restrictive default-src, style-src, img-src, and font-src directives that still permit rendering of inline styles, embedded raster images, and data: fonts. An X-Content-Type-Options: nosniff header is also set. The method is invoked from both the generic sendFile() path and the org-logo endpoint. The enable_svg_logos setting description is updated to warn administrators that SVG files remain XML documents and should be left disabled unless required.", "generatedAt": "2026-09-14T12:47:25.185745Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "e2053fbcffe3476b10ba07239b8772c7760ad987e4574c0bff75f68f8cc05c98", "patchSummary": "Adds RestResponseComponent::sandboxInlineFile(CakeResponse, string) which checks the file type against a whitelist of SVG identifiers (svg, svgz, image/svg+xml, case-insensitive) and, on match, sets Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; font-src data:; frame-ancestors 'self'; sandbox and X-Content-Type-Options: nosniff. Calls this method from sendFile() when download is false, and from OrganisationsController::getOrgLogo() after the file response is built. Updates the enable_svg_logos setting description in Server.php to reflect the sandboxing behaviour and advise leaving the setting disabled. Adds a new PHPUnit test file RestResponseSandboxInlineFileTest.php with cases covering SVG extension, MIME type, svgz, case-insensitivity, and confirmation that raster types (png, jpg, jpeg, gif, webp) and null/empty types receive no headers.", "patchTruncated": false, "patches": [{"commit": "86496aecc35565c121820b8e60eac9508a516eb3", "patchSha256": "e2053fbcffe3476b10ba07239b8772c7760ad987e4574c0bff75f68f8cc05c98", "source": "https://github.com/MISP/MISP/commit/86496aecc.patch", "sourceUrl": "https://github.com/MISP/MISP/commit/86496aecc.patch", "subject": "fix: [security] Sandbox inline-served SVG images"}], "source": "https://github.com/MISP/MISP/commit/86496aecc.patch", "subject": "fix: [security] Sandbox inline-served SVG images", "tagVersionBoundary": {"commits_after_fix": 186, "repository": "https://github.com/MISP/MISP", "tag": "v2.5.46", "version": "2.5.46", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-79", "rationale": "The core issue is that user-supplied SVG content (an XML document capable of embedding script) is served inline on the application origin without any mechanism to prevent script execution, resulting in stored XSS. The fix neutralises the script-execution capability via a sandboxing CSP."}, {"cweId": "CWE-693", "rationale": "The upload-time restriction (enable_svg_logos) was the only protection, and it was insufficient because (a) it could be toggled off after files were already stored, and (b) it did not address the serve path at all. The serve path lacked its own protection mechanism (sandboxing CSP), which is what the patch adds."}]}}}, "recordType": "advisory", "vulnId": "GCVE-1-2026-20098"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T13:58:18.267352Z", "id": "CVE-2026-90957", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T13:58:30.297Z"}}]}}

{}

{"affected": [{"affectedData": [{"modules": ["RestResponseComponent (sendFile / sandboxInlineFile)", "OrganisationsController (getOrgLogo)", "Server model (enable_svg_logos setting)"], "product": "MISP", "programFiles": ["app/Controller/Component/RestResponseComponent.php", "app/Controller/OrganisationsController.php", "app/Model/Server.php"], "repo": "https://github.com/MISP/MISP", "vendor": "MISP", "versions": [{"lessThan": "2.5.46", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.\n\n\nThe commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal <img>, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious <script> elements, event handlers, or javascript: URLs execute on the MISP origin with the viewer\u2019s session.\n\n\nThe affected use cases include:\n\n\n\n\u2003- organisation SVG logos;\n\u2003-\u00a0event-report SVG pictures.\n\n\n\n\n\n\nImportantly, the vulnerable behavior is on the serve path, not merely the upload path: the patch notes that a malicious SVG uploaded while SVG support was enabled could remain dangerous even after uploads were later disabled.\n\n\n\nVersion affected: \u22642.5.45"}], "id": "CVE-2026-90957", "lastModified": "2026-09-14T14:17:21.067", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90957", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T13:58:18.267352Z", "version": "2.0.3"}}]}, "published": "2026-09-14T13:19:32.907", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/MISP/commit/86496aecc"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-693"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{}