CVE-2026-56446 Details
Description
MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process. The fix restricts log destinations to existing directories beneath APP/tmp/logs or /var/log, requires absolute paths, rejects stream wrappers and traversal-related input, and limits filenames to .log or .ndjson extensions while disallowing executable extension segments.
A remote code execution vulnerability exists in MISP due to improper handling of log file paths for the NDJSON error log used by JsonLogTool. An authenticated attacker with site administrator privileges could exploit this by directing log output to a PHP file in a publicly accessible directory and injecting PHP code through the logged data. Accessing the modified file would execute the injected code with the web server's privileges. The vulnerability arises because the log path was not properly validated, allowing for the inclusion of attacker-controlled content.
The vulnerability has been addressed by restricting log destinations to specific directories, requiring absolute paths, rejecting stream wrappers and traversal-related input, and limiting file extensions to .log or .ndjson while disallowing executable extension segments.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/9600d486ccfc98388e13897fd954350cebac5fb0 | CIRCL | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| misp-project misp | < 2.5.42 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | New CVE Received | CIRCL |