A flaw in MISP’s dashboard button widget allowed an attacker to define a URL that appears local but is interpreted by browsers as an external address. The validation rejected explicit schemes, hosts, or user components but tolerated paths beginning with a slash followed by a backslash, such as \/example.com. Browsers normalize backslashes to forward slashes, turning the path into a scheme‑relative link that redirects to an attacker controlled site. The resulting open redirect can be used for phishing, credential theft, or social engineering, without exposing system data or code execution capabilities.

This issue impacts MISP, the open‑source threat intelligence platform, particularly versions that deploy the dashboard button widget. Vendor and product information is recorded as misp:misp, but specific released versions are not listed in the current data. All instances allowing the creation or alteration of dashboard button URLs are potentially vulnerable.

With a CVSS score of 5.1 the vulnerability is classified as moderate severity. No EPSS or KEV presence is reported. The attack vector is user interaction: an attacker who can influence the configuration of a button can embed a malicious link that looks legitimate. Because the redirect occurs client‑side, exploitation is limited to deceiving users rather than compromising the server or broader system state. The risk is primarily to users’ credentials and confidentiality of sensitive data they may enter on external sites.