Which versions of MISP are affected by CVE-2026-56446?

MISP instances face remote code execution risk through the JsonLogTool logging configuration feature accessible to administrators.. A patch is available.

How to fix or mitigate CVE-2026-56446?

24 hours: Identify and document all MISP deployments and their administrator accounts. 7 days: Apply the latest MISP patch available from the vendor GitHub repository to all instances. 30 days: Confirm patch deployment across all systems and review logs for suspicious administrator activity involving JsonLogTool configuration.

MISP CVE-2026-56446

Q: What is the CVSS score of CVE-2026-56446?

CVE-2026-56446 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38229 HIGH

Code Injection (CWE-94)

2026-06-22 CIRCL

GHSA-7v9f-64q7-x2jg

RCE PHP Code Injection Misp

8.7

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Network-reachable admin UI but PR:H because only site_admin can change the setting, AC:H because the attacker must also force valid PHP into a log line, and S:C as code executes as a different OS principal (web server) than the application.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 14:01 vuln.today

Analysis Generated

Jun 22, 2026 - 14:01 vuln.today

DescriptionCVE.org

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process.

The fix restricts log destinations to existing directories beneath APP/tmp/logs or /var/log, requires absolute paths, rejects stream wrappers and traversal-related input, and limits filenames to .log or .ndjson extensions while disallowing executable extension segments.

AnalysisAI

Remote code execution in MISP allows authenticated site administrators to abuse the JsonLogTool NDJSON error log configuration to write attacker-controlled content to a PHP file under the webroot, yielding code execution as the web server user. No public exploit identified at time of analysis, but a vendor patch is available via the MISP GitHub repository.

Technical ContextAI

MISP (Malware Information Sharing Platform) is a PHP/CakePHP threat-intelligence platform. The flaw lives in Server.php where the configuration setting that points JsonLogTool at its NDJSON error log accepted any filesystem path with no validation. Because JsonLogTool appends untrusted, attacker-influenced strings into the log, the path itself becomes a write primitive. The root cause aligns with CWE-94 Improper Control of Generation of Code: the program treats a controllable file name (including its extension and location) as data, when in fact PHP's mod_php / FPM handlers will treat any *.php file under the document root as executable code. The fix introduces a new testLogPath validator that forces absolute paths, resolves symlinks/'..' via realpath, restricts the parent directory to APP/tmp/logs or /var/log, rejects stream wrappers (phar://, php://) and CR/LF/NUL, and restricts file names to .log or .ndjson while blocking dotted segments matching php/phar/phtml/cgi/pl/py/sh/asp/aspx/jsp/exe.

RemediationAI

Upstream fix available (commit 9600d486ccfc98388e13897fd954350cebac5fb0); a released patched version is not independently confirmed in the supplied data, so upgrade to the first MISP release that includes that commit, available from https://github.com/MISP/MISP. Until that upgrade is in place, the practical compensating controls are to leave the JsonLogTool error-log path setting at its default (the built-in path under APP/tmp/logs) and audit Server.settings for any custom value that resolves outside APP/tmp/logs or /var/log, treating any path pointing to a webroot-served directory as an active compromise indicator; additionally, restrict who holds the site_admin role and review the audit log for recent changes to log-path settings. As a deeper defence, configure the web server (Apache/Nginx) to refuse to execute PHP from APP/tmp/logs and /var/log so that even a future log-path bug cannot pivot to RCE - the trade-off is purely operational hardening with no functional side effect on MISP itself.