CVE-2025-67906

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

CVSS 3.1

9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2025-12-15

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• misp-project:misp

References

• https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054
• https://github.com/MISP/MISP/compare/v2.5.27...v2.5.28
• https://github.com/franckferman/CVE-2025-67906
• https://github.com/franckferman/GCVE-1-2025-0030
• https://vulnerability.circl.lu/vuln/gcve-1-2025-0031

Check your stackJSON