GCVE-1-2026-20009 (CVE-2026-94383)
Vulnerability from gna-1 – Published: 2026-09-21 12:51 – Updated: 2026-09-21 12:52
VLAI
EPSS
VEX
Title
MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
Summary
The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.
The vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server's confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.
Version affected: <2.5.47
Severity
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/e5a943178 | patch |
Impacted products
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-21 12:44 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/e5a943178.patch
9b7cc757cbbc… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
e5a9431784b4
|
fix: [security] arbitrary script execution via insufficient | 9b7cc757cbbc… |
Fix summary
The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.
Patch summary
In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing 'txt', 'list', 'blocklist', and 'csv', extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message 'Blocklist filename has an invalid extension.' This check is placed before the existing empty/dot filename validation.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states 'site admin only', requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.
Weakness rationale
- CWE-434 The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434.
- CWE-20 The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue.
Attack pattern rationale
- CAPEC-170 CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate.
Assumptions to verify
- The commit message states 'site admin only', which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.
- The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject 'arbitrary script execution'. The patch does not include web server configuration evidence.
- The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.
- CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.
- The CVSS PR:H rating assumes that 'site admin' in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP's role model.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | medium | 5 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"WorkflowModules/action/Module_blocklist_action"
],
"product": "MISP",
"programFiles": [
"app/Model/WorkflowModules/action/Module_blocklist_action.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
}
],
"value": "The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process.\n\nThe vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server\u0027s confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-170",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-170 File Upload"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/e5a943178"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.\u003c/p\u003e"
}
],
"value": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server."
}
],
"title": "MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The commit message states \u0027site admin only\u0027, which is taken as evidence that the vulnerable workflow module requires MISP site-administrator privileges. The exact privilege model and whether lower-privilege roles could reach this code path is not confirmed by the patch alone.",
"The assumption that the MISP export directory is web-accessible and that the web server is configured to execute scripts (e.g., PHP) from that directory is inferred from the commit subject \u0027arbitrary script execution\u0027. The patch does not include web server configuration evidence.",
"The affected version boundary (prior to v2.5.47) is inferred from the tag_version_boundary metadata showing v2.5.47 as the nearest tag with 142 commits after the fix. The exact first affected version is not stated in the patch.",
"CAPEC-170 (File Upload) is the closest available attack pattern, but the actual mechanism is a workflow parameter specifying a filename rather than a traditional file upload. This mapping is approximate.",
"The CVSS PR:H rating assumes that \u0027site admin\u0027 in MISP corresponds to a high-privilege role requiring authentication and elevated permissions, consistent with MISP\u0027s role model."
],
"capecRationale": [
{
"capecId": "CAPEC-170",
"rationale": "CAPEC-170 describes an attacker uploading or placing a file with a dangerous extension into a target directory where it can be executed. In this case, a site admin specifies a blocklist filename with a dangerous extension (e.g., .php) that is placed in the MISP export directory. The mechanism is not a traditional multipart upload but rather a workflow parameter that results in a file being written to a web-accessible location. CAPEC-170 is the closest available pattern; the uncertainty is that the file is not uploaded via a standard upload endpoint but is instead referenced by name in a workflow action, making the mapping approximate."
}
],
"commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only specifying a filename with a dangerous extension in a workflow parameter; no race conditions or complex timing are needed. AT:N: No manipulation of the target system is required beyond the normal API call. PR:H: The commit message explicitly states \u0027site admin only\u0027, requiring high-privilege MISP access. UI:N: No victim interaction is needed; the workflow action is triggered by the admin themselves. VC:H, VI:H, VA:H: Arbitrary script execution on the MISP server compromises all three local security properties. SC:N, SI:N, SA:N: The impact is confined to the MISP server; no evidence of lateral impact on other systems is present in the patch.",
"fixSummary": "The vulnerability is remediated by enforcing a strict whitelist of allowed file extensions (txt, list, blocklist, csv) on the blocklist filename parameter before the file is processed. Any filename with an extension outside this whitelist is rejected with an error, preventing an attacker from placing files with executable or dangerous extensions (e.g., .php, .phtml) into the MISP export directory where they could be interpreted by the web server.",
"generatedAt": "2026-09-21T12:44:28.234229Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
"patchSummary": "In app/Model/WorkflowModules/action/Module_blocklist_action.php, five lines are inserted after the existing basename() call. The added code defines an $allowedExtensions array containing \u0027txt\u0027, \u0027list\u0027, \u0027blocklist\u0027, and \u0027csv\u0027, extracts the file extension via pathinfo() with PATHINFO_EXTENSION, and performs a strict (===) in_array() check. If the extension is not in the whitelist, the method returns early with a failure message \u0027Blocklist filename has an invalid extension.\u0027 This check is placed before the existing empty/dot filename validation.",
"patchTruncated": false,
"patches": [
{
"commit": "e5a9431784b4a78faddc0cc6efc2a287f2fd3d08",
"patchSha256": "9b7cc757cbbc8a4dd7491c6388e0ee12057c790bb6ca21e10b1d78209bbb7748",
"source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/e5a943178.patch",
"subject": "fix: [security] arbitrary script execution via insufficient"
}
],
"source": "https://github.com/MISP/MISP/commit/e5a943178.patch",
"subject": "fix: [security] arbitrary script execution via insufficient",
"tagVersionBoundary": {
"commits_after_fix": 142,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-434",
"rationale": "The blocklist filename parameter accepted arbitrary file extensions without restriction. A site admin could supply a filename with a dangerous extension (e.g., .php) that would be placed in a web-accessible export directory, enabling script execution. The fix restricts extensions to a safe whitelist, which is the canonical remediation for CWE-434."
},
{
"cweId": "CWE-20",
"rationale": "The filename parameter was not validated against a set of acceptable values (extensions). Only path stripping and empty-string checks were performed, leaving the extension entirely unvalidated. This is a general improper input validation weakness that enabled the more specific dangerous-file-type issue."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20009"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-94383",
"datePublished": "2026-09-21T12:51:51.619869Z",
"dateReserved": "2026-09-21T12:52:01.101Z",
"dateUpdated": "2026-09-21T12:52:01.169089Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20009"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…