The flaw lies in the EventReport::uploadPicture function, which processes an attacker‑supplied tmp_name parameter by probing the filesystem with file_exists, mime_content_type, and exif_imagetype before verifying that the file is a legitimate PHP upload. Because this validation gate is missing, an authenticated user with the perm_add privilege can supply any path, causing the application to reply with distinct error messages that reveal whether a file exists, its MIME type, and its image format. The result is an information disclosure vulnerability that leaks the server’s filesystem layout and file types to any user with that role, although it does not grant read, write, or execution capabilities. The disclosed data can facilitate subsequent attacks by pointing attackers to configuration files, private keys, or other sensitive artifacts on the host.

The vulnerability affects installations of MISP, specifically the EventReport component. Any deployed instance of MISP that allows users with the perm_add permission to invoke the uploadPicture endpoint is susceptible; no version range is specified, meaning the issue may exist in all current or older releases until the patch is applied.

With a CVSS score of 5.3, the threat is classified as medium severity. The exploit does not require administrative rights beyond the assigned perm_add role, so anyone who can authenticate with that privilege can run the attack. EPSS data are not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The attacker’s ability to enumerate arbitrary filesystem paths can aid more serious attacks, so the risk remains notable for organizations that keep sensitive files on the same server as MISP.