MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox.
The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal
![]()
, they can execute when the SVG is navigated to directly or embedded as a document. In that case, malicious
