app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.
GHSA-w7p3-5r7j-j9pc: app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site...
MISP before 2.5.27 has a path traversal vulnerability in app/Model/EventReport.php that allows site-admins to view pictures outside intended directories.