The vulnerability in MISP versions up through 2.5.45 allows any authenticated user to call TemplatesController::uploadFile(). The ACL entry used a wildcard which bypassed the intended role restrictions for template-related actions. As a result, users without perm_add or perm_template permissions can upload arbitrary files. The upload logic performs only minimal validation and writes the files to app/tmp/files/, where filenames are randomized and the directory is outside the web root. Because the files are not served directly, the flaw does not provide a vector for stored XSS or remote code execution, but repeated uploads can consume disk space.

Affected systems are installations of MISP up to and including version 2.5.45. The vulnerability is vendor specific to MISP and affects the TemplatesController upload functionality.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, and the bug is not listed in the CISA KEV catalog. The likely attack scenario requires an authenticated user, which can be a low‑privileged or read‑only account. By uploading many files, such a user can exhaust available disk space on the host, resulting in a denial of service. The lack of path traversal or predictable overwrites limits the potential for more destructive attacks beyond disk exhaustion.