During STIX 2 import or MISP‑to‑STIX 2 export, the misp‑stix library constructs a file system path from an untrusted object name. A crafted name containing path separators or traversal sequences can cause the template‑resolution mechanism to escape the configured object‑template directory and load a definition.json file from an arbitrary location. This allows an attacker to read locally accessible files that belong to the process, or to inject malicious template definitions that alter the resulting object’s metadata, potentially exposing sensitive data or changing security context.

The vulnerability affects the misp‑stix library maintained by the MISP project. No specific affected versions are listed in the advisory, so any deployed release should be reviewed and patched according to the vendor’s update schedule.

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS is not available and the issue is not listed in CISA’s KEV catalog, but the potential for unauthorized file access and information disclosure makes it a serious risk. The likely attack vector is through malicious STIX objects or custom MISP events processed during import or export, so any system exposed to external STIX data needs urgent attention.