EUVD-2026-84466
GHSA-8rgx-3gvf-26gg
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated MISP user (PR:L) over network (AV:N); AC:H because no native reachable sink - exploitation must chain a separate path-influence/upload primitive plus gadget; full RCE gives C/I/A:H.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
2DescriptionCVE.org
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:
- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;
- a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.
No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
AnalysisAI
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires PHP's phar:// stream wrapper being registered (default in affected MISP builds) AND an attacker who can (1) influence a filesystem-path argument passed to a filesystem operation so it resolves to a phar archive, and (2) place/upload an attacker-crafted phar archive reachable by that path, plus a usable PHP POP gadget chain for the unserialize() sink or executable code inside the phar for the RCE-via-relocated-app-root variant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H = 7.7 High) and the CWE-502/RCE framing look alarming, but the description itself is the most important signal and it downgrades real-world risk substantially. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix commit 08fa755b6, which registers no phar wrapper by placing `stream_wrapper_unregister('phar')` guarded by an `in_array('phar', stream_get_wrappers(), true)` check at the very top of both app/Console/cake.php and app/webroot/index.php, before any other code executes; because the fix is a commit rather than a documented tagged release, treat it as an upstream fix available (PR/commit) and confirm the exact packaged/patched version with the vendor before relying on a version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm all MISP deployments, including web entry point app/webroot/index.php and console entry point app/Console/cake.php, are running a patched version by applying the vendor fix commit 08fa755b6 or the corresponding patched MISP release per the vendor advisory, verify the phar stream wrapper is unregistered, and restrict MISP access to trusted authenticated accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today