CVE-2025-66384
High · 8.2CVSS
8.2
EPSS
0.4%
Published
Nov 28, 2025
CISA due date
—
The record
app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79126 Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows… CWE-684
- CVE-2026-52735 ZEBRA is a Zcash node written entirely in Rust. CWE-684
- CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell… CWE-684
- CVE-2026-40684 In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the… CWE-684
- CVE-2026-42255 Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server… CWE-684
- GHSA-532v-xp3f-837c uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut… CWE-684
- GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue CWE-684
- CVE-2026-35381 A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s… CWE-684