An issue exists in MISP prior to 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.
misp misp