CVE-2025-67906
criticalIn MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.
Vendor / product: Misp-project — misp
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.
CVSS
9.0
9.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-12-15 04:15
Modified: 2026-10-14 13:10
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
misp-project / misp <2.5.28
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054
References
- https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054 cve@mitre.org
- https://github.com/MISP/MISP/compare/v2.5.27...v2.5.28 cve@mitre.org
- https://github.com/franckferman/CVE-2025-67906 cve@mitre.org
- https://github.com/franckferman/GCVE-1-2025-0030 cve@mitre.org
- https://vulnerability.circl.lu/vuln/gcve-1-2025-0031 cve@mitre.org
- https://github.com/franckferman/CVE-2025-67906 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗