A path traversal vulnerability in the misp-stix library could allow unauthenticated attackers to access sensitive files on the host system.

This is a path traversal vulnerability (CWE-22) occurring during the handling of MISP object template names. The vulnerability is exploitable by unauthenticated remote attackers who can influence the input processed by the library.

Successful exploitation allows an attacker to read sensitive files outside of the intended directory, potentially leading to the exposure of configuration files, credentials, or system data. With a CVSS score of 8.8, this vulnerability represents a high risk to the confidentiality of the environment, as it grants unauthorized access to system resources.

Immediate Action: Upgrade the misp-stix package to a version beyond 2026.7.8, utilizing the fixes provided in the upstream commits a8b6808d and a0f54070.

Proactive Monitoring: Review application logs for suspicious path patterns or directory traversal attempts (e.g., sequences like ../) within inputs related to STIX 2 imports.

Compensating Controls: Implement strict input validation or use a Web Application Firewall to filter requests containing directory traversal characters before they reach the application.

Public Exploit Available: No (no confirmed public exploit in available data)

Given the high CVSS score and the potential for unauthorized file access, organizations should prioritize updating the misp-stix library immediately. Ensure that all downstream applications utilizing this package are tested after the update to maintain system integrity.