CVE-2025-67906: Misp-Project Misp

Critical severity, CVSS 9.0. EPSS: 0.3% chance of exploitation in the next 30 days.

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

Affected products

• Misp-Project Misp: before 2.5.28 (fixed in 2.5.28)

Published 2025-12-15. Last modified 2026-06-22.