CVEFinder.io

CVE-2026-56446

⚠️ high
πŸ” Scan for this CVE
Summary

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process. The fix restricts log destinations

Description

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process.

The fix restricts log destinations to existing directories beneath APP/tmp/logs or /var/log, requires absolute paths, rejects stream wrappers and traversal-related input, and limits filenames to .log or .ndjson extensions while disallowing executable extension segments.

CVSS Score
7.2
High
EPSS Score
0.4
Exploit Probability
Published Date
2026-06-22
First Seen: 2026-06-25
πŸ“Š Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 54.3% of all 360,673 vulnerabilities in our database.

#164,897
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 23, 2026
πŸ” Exploitation Status
None
No known exploits
βš™οΈ Automatable
NO
Requires human interaction
πŸ’₯ Technical Impact
Total
Complete system compromise possible
πŸ† Discovered By
Jakub ChyliΕ„ski Andras Iklody (remediation developer)
SSVC data provided by CISA
Last Modified 2026-06-23
Source NVD πŸ”—
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-94

πŸ“¦ Affected Products 1

Vendor Product Status Affected Versions
misp-project misp Affected
< 2.5.42

πŸ”— References 1

https://github.com/MISP/MISP/commit/9600d486ccfc9838...
Patch

πŸ”— Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-86342 πŸ”Ά medium 4.3 0.2 Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview ... 2026-09-07
CVE-2026-86347 πŸ”Ά medium 6.5 0.3 Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry... 2026-09-07
CVE-2026-86351 πŸ”Ά medium 6.1 0.2 Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with... 2026-09-07
CVE-2026-86408 πŸ”Ά medium 6.5 0.2 Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKe... 2026-09-07
CVE-2026-86417 πŸ”Ά medium 4.3 0.2 Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). T... 2026-09-07
CVE-2026-86418 πŸ”Ά medium 4.3 0.2 Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the sa... 2026-09-07
These CVEs affect the same products