FindOrgImage in MISP's OrgImgHelper concatenates an attacker‑controlled organization identifier with a fixed directory path and file extension, then calls file_exists() on the resulting path. Because no validation was performed before the path construction, an organization name containing directory traversal sequences such as ../../etc/passwd can cause the resolved path to reference any file under the MISP process’s access. The vulnerability yields an arbitrary file existence oracle and allows a user to retrieve the contents of files that end with .png or .svg extensions via the returned image reference.

Affected product is MISP, as listed by its CNA. The flaw exists in the OrgImgHelper component and is present in any MISP installation that uses the vulnerable findOrgImage method before the commit that introduced input validation. The organization name is set during event import, so any instance that allows authenticated users to import events with arbitrary organization names is impacted.

The CVSS score of 5.3 indicates medium severity, primarily because the vulnerability requires authenticated access with the ability to create or import events. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog, suggesting that no widespread active exploitation is reported. The likely attack vector is an authenticated user who can set the organization name during event import; the attacker can learn whether arbitrary files exist and, for files with .png or .svg extensions, can read and view their contents.