MISP CVE-2026-93295

Requires the ability to submit the MISP events/contact form (contact-reporter feature) or any other endpoint that forwards user input into background-job arguments, on an unpatched MISP instance older than 2.5.47. The attacker must be able to set two adjacent caller-controlled fields - 'person' (set to a reserved console switch such as '-app') and 'message' (set to a phar:// URI) - and must be able to stage or reference a malicious phar archive reachable by the web process. Per CVSS PR:L the contact form requires an authenticated MISP user. No user interaction by a victim, no special timing, and no race condition are needed; exploitation is deterministic once the crafted parameters are accepted. Limiting factors: authenticated access to the submitting endpoint and the patch level (fixed in 2.5.47).

This is a genuinely high-priority flaw despite mixed signals. The vulnerability is unauthenticated-by-configuration-but-CVSS-authenticated: the vendor 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) is well-supported by the description - network-reachable, low-complexity, deterministic (no race/timing), full RCE as the web user. PR:L reflects that submitting the events/contact form requires an authenticated MISP account. The signals that pull risk DOWN are the SSVC and EPSS: SSVC reports Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial, while EPSS is only 0.50% (42nd percentile). Note the internal tension - SSVC 'Technical Impact: partial' understates what the description and code evidence establish (full RCE with data exfiltration, persistence, and lateral movement), so treat the SSVC technical-impact rating as conservative/inconsistent with the confirmed impact. There is NO CISA KEV listing and no public exploit was identified in the input, so the low EPSS reflects absence of observed weaponization rather than low exploitability - the technique itself is deterministic and reliable once the crafted parameters are accepted. Net: prioritize patching for any authenticated-accessible MISP instance; the primary mitigating factor is the authentication requirement, not any technical difficulty.

An authenticated user (or anyone who can reach the events/contact form) submits a contact request setting the 'person' field to the reserved console switch '-app' and the 'message' field to a phar:// URI pointing to an attacker-staged malicious archive on the host. These reach the CakePHP console as adjacent argv elements; ShellDispatcher::_parsePaths() treats '-app' as an application-root switch and loads Config/core.php from inside the phar archive, executing attacker PHP as the web-server user. No public exploit was identified at time of analysis, but the code diff confirms the mechanism and the attack is deterministic with low complexity (AC:L).