Misskey: Denial of service via repeated file uploads
Summary
Misskey, an open source federated social media platform, may not run its cleanup of temporary files after file uploads. An unauthenticated attacker on the network can send repeated uploads to exhaust storage or file descriptors, which makes the service unavailable. The issue applies regardless of whether federation is enabled.
Affected
- Misskey 13.0.0 up to 2025.4.1 (per CVE description)
- Misskey 2025.5.0 up to 2026.7.0 (per CVE description)
- The CVE record lists wider ranges (from 12.0.0 to 13.14.2 and from 2023.9.0-beta.1). Unconfirmed, verify against the GitHub advisory.
Fixed in
- Misskey 2026.7.0 or later
Workaround
- Unknown. No vendor workaround is documented in the sources reviewed.
- Until patched, restrict or rate-limit upload endpoints at the reverse proxy and monitor disk usage and temporary directories.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept or known exploitation in the sources reviewed.
- Not listed in CISA KEV.
Our recommendation
- Check whether any Misskey instance is running, including test or community servers, and confirm its version.
- Upgrade to Misskey 2026.7.0 or later.
- Until then, limit upload exposure at the reverse proxy and monitor disk space and temporary files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Misskey commit 3f28489 (fix for temporary file cleanup) github.com
- Misskey pull request #17750 github.com
- Misskey release 2026.7.0 github.com
- GitHub Security Advisory GHSA-m9xp-2fvm-pfmq github.com
- OSV: CVE-2026-103937 osv.dev
- Mend via Vulners: CVE-2026-103937 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:23.
Original description (NVD)
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardless of whether federation is enabled. This issue is fixed in version 2026.7.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.