The vulnerability allows an authenticated user with perm_galaxy_editor permission to create or modify a galaxy whose name contains arbitrary HTML or JavaScript. The name is interpolated verbatim into the galaxy matrix statistics page via sprintf without HTML encoding. When any user opens that page, the embedded script executes in the victim’s browser, allowing the attacker to hijack the user session, steal credentials, exfiltrate data or perform unauthorized actions within the MISP application.

The CVE affects the MISP open‑source security information platform (MISP) deployed at versions older than 2.5.47. The vulnerable code resides in the view file statistics_galaxymatrix.ctp within the application.

The CVSS score of 6.3 classifies this as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. An attacker must first be authenticated and possess the perm_galaxy_editor capability. Once a malicious galaxy is created, the stored script will impact any authenticated user that later views the statistics page, resulting in potential session theft or other browser‑side attacks. The risk therefore depends on the attacker’s ability to obtain the required permissions and the exposure of users to the vulnerable page. Given the requirement for privilege and the lack of observed exploits, the likelihood of exploitation is considered low to moderate.