This vulnerability is a path traversal issue located in the OrganisationsController::getOrgLogo method of MISP. Attackers who can influence organization fields such as the name can manipulate the constructed logo path to reference files outside the intended images directory. The flaw permits retrieval of arbitrary .png or .svg files that reside beyond the orgs folder, effectively leaking sensitive assets. The weakness is a classic CWE‑22: Path Traversal. In the worst case, an attacker could expose configuration files or other private data if such files are accessible via the web process, leading to users’ confidentiality compromise.

The flaw targets the MISP platform (misp:misp). Any installation that has not applied the fix carried out in commit b865deb036ca82dab272be260798f562034ba9ae is vulnerable. The patch adds realpath validation to ensure resolved paths stay within APP/files/img/orgs. Administrators should verify whether their current MISP deployment runs a version older than this commit and, if so, upgrade accordingly.

The CVSS v3 score of 5.3 classifies the issue as medium severity, reflecting that exploitation requires the ability to modify organization attributes. No EPSS score is published, and the vulnerability is not yet listed in CISA KEV. If attackers can inject malicious organization names or payloads, they may read arbitrary PNG or SVG files. The exploit chain is straightforward: influence an organization field, trigger the logo endpoint, and receive the requested file. Mitigation rests mainly on applying the upstream patch and limiting who can alter organization details.