CVE-2025-67906

CRITICAL EPSS 19.0%
Published Dec 15, 20256mo ago · Modified Jun 22, 20261w ago
9.0 CVSS 3.1
Critical
Find Similar
Published Dec 15, 2025 6mo ago
Last Modified Jun 22, 2026 1w ago

Description

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

CVSS Details

Base Score
9.0
Exploitability
2.3
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
19.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
misp-projectmisp* <2.5.28

References 5

  • github.com https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054
    Patch
  • github.com https://github.com/MISP/MISP/compare/v2.5.27...v2.5.28
    Release Notes
  • github.com https://github.com/franckferman/CVE-2025-67906
    Third Party Advisory
  • github.com https://github.com/franckferman/GCVE-1-2025-0030
    Third Party Advisory
  • vulnerability.circl.lu https://vulnerability.circl.lu/vuln/gcve-1-2025-0031
    Third Party Advisory

Remediation

  • github.com https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054
    Patch