CVE-2026-94277 — Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An a…
Published: 2026-09-21 · CVSS: 6.3 · CVSS 4.0
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7