In MISP, the OrganisationsController::__uploadLogo method accepts a caller‑supplied tmp_name parameter and performs file system probes (file_exists, MIME type detection, EXIF reading) before checking that the parameter represents a genuine PHP upload via is_uploaded_file. An authenticated site‑admin can supply any server file path as tmp_name, causing the application to report distinct validation error messages that reveal whether the file exists and, for image files, its image type. This results in a file‑existence and image‑type oracle that discloses server file information but does not enable arbitrary read, code execution, or data modification.

The vulnerability is present in the MISP application, specifically in the OrganisationsController of the MISP repository. Affected product versions are not enumerated in the CVE data, so any instance of MISP deploying this controller before the patch may be impacted. The referenced commit 12eaadc9e introduces a guard that prevents filesystem interaction with unauthenticated paths. Administrators should verify whether their deployment uses the updated code.

The CVSS score of 5.1 indicates a medium severity. Since the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation appears low. However, an attacker who gains site‑admin privileges can actively probe the server file system, learning the existence and type of arbitrary files, which can aid lateral movement or reconnaissance. The attack requires authentication, making it partially mitigated by standard role‑based access controls; nevertheless, strong admin authentication and monitoring of upload logs are essential to reduce risk.