PT-2025-48316 · Misp · Misp

Published 2025-11-28 · Updated 2025-11-29 · CVE-2025-66384

Positive Technologies · (AI Summary)

CVSS v3.1

8.2

8.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.24

Description The software contains flawed logic when validating uploaded files, specifically concerning the

tmp name

parameter. This issue resides in the

app/Controller/EventsController.php

file.

Recommendations Update to version 2.5.24 or later.

Fix

Weakness Enumeration

CWE-684

Related Identifiers

CVE-2025-66384

Affected Products

Misp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-66384 · Security Note
• https://github.com/misp/misp/commit/6867f0d3157a1959154bdad9ddac009dec6a19f5 · Note
• https://github.com/MISP/MISP/compare/v2.5.23...v2.5.24 · Note
• https://twitter.com/CVEnew/status/1994304556964995557 · Twitter Post
• https://t.me/cveNotify/144208 · Telegram Post
• https://t.me/CVEtracker/38428 · Telegram Post
• https://twitter.com/gothburz/status/1994784051996090599 · Twitter Post