PT-2025-48316 · Misp · Misp

Published 2025-11-28 · Updated 2025-12-03 · CVE-2025-66384

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.24

Description The software contains flawed logic when validating uploaded files, specifically concerning the tmp name parameter. This issue resides in the app/Controller/EventsController.php file.

Recommendations Update to version 2.5.24 or later.

Fix

Weakness Enumeration

CWE-684

Related Identifiers

CVE-2025-66384

Affected Products

Misp

References · 9

• https://osv.dev/vulnerability/CVE-2025-66384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66384 · Security Note
• https://github.com/misp/misp/commit/6867f0d3157a1959154bdad9ddac009dec6a19f5 · Note
• https://github.com/MISP/MISP/compare/v2.5.23...v2.5.24 · Note
• https://t.me/CVEtracker/38428 · Telegram Post
• https://twitter.com/gothburz/status/1994784051996090599 · Twitter Post
• https://twitter.com/cracbot/status/1996172622686728269 · Twitter Post
• https://t.me/cveNotify/144208 · Telegram Post
• https://twitter.com/CVEnew/status/1994304556964995557 · Twitter Post