MISP's file upload mechanism lacked validation of XML structure, allowing authorized users to upload content that the server treated as a file path or external URL and then parsed. This flaw lets an attacker read any file the application can access or force the server to retrieve data from an arbitrary internal URL. The impact is the exposure of local files and the ability to probe internal services, compromising confidentiality and potentially availability of the targeted system. The weakness is a classic path traversal/XML external entity (CWE‑73 and CWE‑918).

All MISP installations earlier than version 2.5.47 are affected. An authenticated user with modify privileges can upload a crafted XML file that disables expected checks in the addMISPExportFile() endpoint, triggering an unsafe XML parse and permitting local file reads or internal HTTP requests.

The CVSS score of 8.3 places this vulnerability in the High severity category. The EPSS score is not available, so exact exploitation probability remains undefined but is not considered negligible. It is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker only needs a valid MISP account with modify rights and no further user interaction, so the primary attack vector is an authenticated file upload that triggers unsafe XML processing, resulting in arbitrary file read or SSRF.