PT-2026-38424 · Misp · Misp

Bjørn Helseth + 1 · Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-8080

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Green

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.37

Description A stored cross-site scripting issue exists in the template element attribute handling logic. The application fails to validate arbitrary values for the TemplateElementAttribute type and category fields against known attribute type and category definitions. This allows an attacker with permissions to create or modify template element attributes to store a crafted type value. This issue specifically affects the old templating engine, which is no longer accessible in version 2.5.37 and is scheduled for removal in version 2.5.38.

Recommendations Update to version 2.5.37 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8080

Affected Products

Misp

References · 4

• https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8080 · Security Note
• https://twitter.com/CVEnew/status/2052400772831396064 · Twitter Post
• https://t.me/cveNotify/162508 · Telegram Post