CVEFinder.io

CVE-2026-56446

⚠️ high
πŸ” Scan for this CVE
Summary

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process. The fix restricts log destinations

Description

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process.

The fix restricts log destinations to existing directories beneath APP/tmp/logs or /var/log, requires absolute paths, rejects stream wrappers and traversal-related input, and limits filenames to .log or .ndjson extensions while disallowing executable extension segments.

CVSS Score
7.2
High
EPSS Score
0.4
Exploit Probability
Published Date
2026-06-22
First Seen: 2026-06-25
πŸ“Š Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.5% of all 329,778 vulnerabilities in our database.

#146,887
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 23, 2026
πŸ” Exploitation Status
None
No known exploits
βš™οΈ Automatable
NO
Requires human interaction
πŸ’₯ Technical Impact
Total
Complete system compromise possible
πŸ† Discovered By
Jakub ChyliΕ„ski Andras Iklody (remediation developer)
SSVC data provided by CISA
Last Modified 2026-06-23
Source NVD πŸ”—
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-94

πŸ“¦ Affected Products 1

Vendor Product Status Affected Versions
misp-project misp Affected
< 2.5.42

πŸ”— References 1

https://github.com/MISP/MISP/commit/9600d486ccfc9838...
Patch

πŸ”— Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-56423 ⚠️ high 8.8 0.3 MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The a... 2026-06-22
CVE-2026-56424 ⚠️ high 8.8 0.4 MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong ent... 2026-06-22
CVE-2026-56447 ⚠️ high 7.2 0.3 MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path... 2026-06-22
CVE-2026-10854 πŸ”Ά medium 4.3 0.2 A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxi... 2026-06-04
CVE-2026-10855 πŸ”Ά medium 4.3 0.2 An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template i... 2026-06-04
CVE-2026-10856 πŸ”Ά medium 6.1 0.2 A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a loc... 2026-06-04
These CVEs affect the same products