CVE-2026-103388
Severity CVSS v4.0:
MEDIUM
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
30/09/2026
Last modified:
30/09/2026
Description
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.<br />
<br />
When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.<br />
<br />
Preconditions:<br />
<br />
- Attacker must hold galaxy editor privileges (local or via sync).<br />
<br />
- Victim must view the affected cluster and click the malicious link.<br />
<br />
Impact:<br />
<br />
- Stored cross-site scripting (XSS) in the victim&#39;s browser.<br />
<br />
- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.<br />
<br />
Affected:
Impact
Base Score 4.0
6.20
Severity 4.0
MEDIUM