MISP CVE-2026-56446

Requires an authenticated MISP site_admin account (the only role permitted to change Server settings), and a deployment in which the MISP web server can serve and execute PHP from a directory that the OS user running MISP can also write to - typically the standard layout where /var/www/MISP/app/webroot is both web-served and writable by www-data. The attacker must additionally be able to cause JsonLogTool to emit a log line whose content forms syntactically valid PHP after JSON encoding, which is what underlies the AC:H rating. Exploitation is not possible without site_admin (the configuration field is not exposed to lower roles) and is blocked entirely on instances already running the commit 9600d486 fix.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, base 8.7) is internally consistent with the description: full RCE impact but gated behind site-administrator privileges (PR:H) and non-trivial attack complexity (AC:H) because the attacker must both point the log at an executable path under the webroot AND coax a log line containing valid PHP into being written. There is no CISA KEV listing and no EPSS score supplied, and the references contain only the patch commit - so no public exploit identified at time of analysis. Real-world risk is therefore a post-authentication privilege-to-RCE pivot: relevant where the site-admin account is not equivalent to OS root (e.g. multi-tenant or partially delegated MISP deployments), and as a persistence/lateral-movement step after credential compromise. Pure perimeter risk is low because the attacker already needs the highest in-app role.

An attacker who has obtained MISP site-administrator credentials (via phishing, reused credentials, or another vuln) browses to the Server Settings page, changes the JsonLogTool ndjson error-log path to something like /var/www/MISP/app/webroot/img/shell.php, then deliberately triggers an error containing a crafted PHP payload (for example by submitting an event/attribute whose value is reflected into the JSON error context). Once the log line is written, the attacker fetches the file via the MISP web server to execute the payload as the www-data/apache user. No public exploit identified at time of analysis.