CVE-2026-95806 Details
Description
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink; - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user. No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
A vulnerability exists in MISP due to the phar stream wrapper being registered in both the web and console entry points. This registration allows PHP to treat phar archives as directories, leading to two security issues: first, any filesystem operation on a path influenced by the caller that points to a phar archive will trigger an implicit unserialize() call, creating a deserialization sink; second, a relocated application root can access executable code inside an uploaded phar file, potentially allowing arbitrary code execution as the web user. No part of MISP, the included CakePHP framework, or any runtime-loaded library interacts with phar archives, making the stream wrapper unnecessary and a potential attack vector for influencing filesystem path arguments.
The phar stream wrapper has been unregistered in the web entry point and the console entry point, removing the vulnerability. Users should update to MISP version 2.5.47, where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/MISP/commit/08fa755b6 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CIRCL |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| MISP | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | New CVE Received | CIRCL |
| Sep 22, 2026 | CVE Modified | CISA-ADP |