The vulnerability arises when an authenticated user can create or rename an organization and supply an organization name containing directory traversal sequences such as ../../.. . The MISP code concatenates this unvalidated name into a filesystem path and checks for the existence of a logo file via file_exists. If the target directory existed, the attacker could probe for arbitrary files on the server, gaining knowledge of file presence without reading content. The weakness is a standard path traversal scenario (CWE‑22).

All installations of the MISP software (MISP:MISP) are potentially affected. No specific version range is supplied, so the issue applies to any deployment that still uses the legacy logo lookup code.

The CVSS base score is 5.1, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permissions to create or rename organizations, which is common for administrative roles. The attacker only learns whether a file exists; the directory itself does not change, so the risk is primarily information disclosure rather than arbitrary code execution or data loss.