CVE Feed

    Dashboard / CVE / CVE-2026-95806

    CVE-2026-95806

    MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.  The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:    - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;  - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user. No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.

    Published:Sep 22, 2026
    Last Modified:Sep 22, 2026
    EPS:Sep 22, 2026
    EPSS Score:
    CVSS Score:7.7

    Affected Products

    Vendor
    Misp
    Product
    Misp

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-10 Buffer Overflow via Environment Variables
    CAPEC-101 Server Side Include (SSI) Injection
    CAPEC-105 HTTP Request Splitting
    CAPEC-108 Command Line Execution through SQL Injection
    CAPEC-120 Double Encoding
    CAPEC-13 Subverting Environment Variable Values
    CAPEC-135 Format String Injection
    CAPEC-14 Client-side Injection-induced Buffer Overflow
    CAPEC-24 Filter Failure through Buffer Overflow
    CAPEC-250 XML Injection
    CAPEC-267 Leverage Alternate Encoding
    CAPEC-273 HTTP Response Smuggling
    CAPEC-28 Fuzzing
    CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
    CAPEC-34 HTTP Response Splitting
    CAPEC-42 MIME Conversion
    CAPEC-43 Exploiting Multiple Input Interpretation Layers
    CAPEC-45 Buffer Overflow via Symbolic Links
    CAPEC-46 Overflow Variables and Tags
    CAPEC-47 Buffer Overflow via Parameter Expansion
    CAPEC-51 Poison Web Service Registry
    CAPEC-52 Embedding NULL Bytes
    CAPEC-53 Postfix, Null Terminate, and Backslash
    CAPEC-586 Object Injection
    CAPEC-6 Argument Injection
    CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
    CAPEC-67 String Format Overflow in syslog()
    CAPEC-7 Blind SQL Injection
    CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
    CAPEC-72 URL Encoding
    CAPEC-76 Manipulating Web Input to File System Calls
    CAPEC-78 Using Escaped Slashes in Alternate Encoding
    CAPEC-79 Using Slashes in Alternate Encoding
    CAPEC-8 Buffer Overflow in an API Call
    CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic
    CAPEC-83 XPath Injection
    CAPEC-84 XQuery Injection
    CAPEC-9 Buffer Overflow in Local Command-Line Utilities

    Related CVEs

    CVE-2026-112192 (CVSS 5.3) — MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-suppl…
    CVE-2026-112188 (CVSS 7.1) — MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to ret…
    CVE-2026-112184 (CVSS 4.8) — MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter…
    CVE-2026-112183 (CVSS 4.8) — MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event…
    CVE-2026-112180 (CVSS 5.1) — MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associa…
    CVE-2026-112179 (CVSS 5.3) — In MISP, the event synchronization process contained a logic error in the preparation of event reports for rem…
    CVE-2026-112178 (CVSS 7.1) — MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization ch…
    CVE-2026-107278 (CVSS 5.3) — MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a d…
    CVE-2026-107276 (CVSS 6.3) — MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests c…
    CVE-2026-107180 (CVSS 7.1) — On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandato…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High