A malicious SVG file uploaded to MISP and served inline without a restrictive browser sandbox can contain embedded scripts, event handlers, or javascript URLs that, when viewed by another authenticated user, execute in the victim’s browser in the context of the MISP origin. This stored cross‑site scripting flaw allows a threat actor to run arbitrary scripting code, potentially stealing session cookies, defacing the UI, or redirecting traffic. The weakness arises from insufficient application of Content‑Security‑Policy headers for inline SVG content.

The vulnerability affects the MISP platform, particularly the organization logos and event‑report pictures functionalities, for all versions up to and including 2.5.45. The issue is present in the file serve path, not just the upload path, meaning previously uploaded SVG images remain dangerous even after disabling later uploads.

The CVSS score of 5.1 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. A likely an SVG file while SVG support is enabled; the malicious file can then be rendered by other authenticated users, executing the embedded code. Because the flaw persists on the serve path even after upload functionality is disabled, timely remediation is critical.