CVE-2025-67906 is a medium severity (CVSS 5.4) cross site scripting flaw in MISP before 2.5.28. The workflow execution path template does not handle some content safely. Upgrade to MISP 2.5.28 and review who is allowed to build or edit workflows.
What's affected
MISP versions before 2.5.28. The record names the template app/View/Elements/Workflows/executionPath.ctp as the place of the flaw and lists the project's fix commit and the comparison between v2.5.27 and v2.5.28.
MISP is a threat intelligence sharing platform, so the users who see the page are analysts and administrators, often with high privileges. A stored script in an analyst view can act with the viewer's rights. That is why a medium score still deserves a patch window.
The record lists third party write ups. I did not fetch them, so no further technical details are added here.
How to check if you're exposed
Find the version in the MISP web interface, in the administration area that shows the running version and checks for updates. On the server you can also look at the version file in the MISP root:
cat /var/www/MISP/VERSION.json
If you installed in a different directory, adjust the path. If your instance is older than 2.5.28, update. Check the project documentation for the supported update path for your install method, since MISP offers an in app update as well as command line steps.
What to do now
- Check the version of every MISP instance, including test and community ones.
- Update to 2.5.28 or later using the project update process.
- Review who has permission to create or edit workflows, and remove it where it is not needed.
- Check existing workflows for entries that look unusual.
- Log out and back in after the update so that sessions do not carry old state.
Why it matters
The weakness is CWE-79, cross site scripting. A template places data into a page without encoding it for the HTML context, so that data can be read by the browser as markup or script.
Output encoding is the standard fix, and the project applied it in the template. Security platforms deserve extra care here: they ingest content from external feeds and partners, so they handle untrusted data all day, and analysts using them hold powerful sessions. The record does not list this CVE as known exploited.
Quick check
Why patch a medium issue?
MISP users often hold high privileges, and the platform displays content from outside sources. Script in an analyst view can act as that analyst.
What is the fix version?
MISP 2.5.28, per the record.
Sources
- Safeguard Gold page for CVE-2025-67906
- Fix commit in the MISP repository (listed in the record)
- Comparison of v2.5.27 and v2.5.28 (listed in the record)
Last reviewed: 18 October 2026.
