CVE-2026-103388
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
30/09/2026
Última modificación:
30/09/2026
Descripción
*** Pendiente de traducción *** MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.<br />
<br />
When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.<br />
<br />
Preconditions:<br />
<br />
- Attacker must hold galaxy editor privileges (local or via sync).<br />
<br />
- Victim must view the affected cluster and click the malicious link.<br />
<br />
Impact:<br />
<br />
- Stored cross-site scripting (XSS) in the victim&#39;s browser.<br />
<br />
- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.<br />
<br />
Affected:
Impacto
Puntuación base 4.0
6.20
Gravedad 4.0
MEDIA