rootpwn

critical · CVSS v3 9.8 · CVSS v4 5.1

CVE-2026-93295

MISP’s background job dispatcher accepts user‑controlled arguments without validation, enabling an attacker to inject a phar:// URI that is

Overview

MISP’s background job dispatcher accepts user‑controlled arguments without validation, enabling an attacker to inject a phar:// URI that is executed as PHP code under the web server’s user. This results in full remote code execution (RCE) on the host, compromising confidentiality, integrity, and availability of the MISP instance.

Description

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.

Impact

The vulnerability allows an attacker who can submit the events/contact form (or any endpoint that forwards user input to background jobs) to run arbitrary PHP code with the privileges of the MISP web server process. This can lead to data exfiltration, persistence, and lateral movement within the host, affecting confidentiality, integrity, and availability of the system.

Remediation

['Apply the latest MISP patch or upgrade to a version that has fixed the background job argument handling.', 'If an upgrade is not immediately possible, restrict the background job dispatcher by disabling or removing the affected endpoints (e.g., events/contact) until a patch is applied.', 'Implement input validation or sanitization for all fields that are forwarded to background jobs, ensuring that no command‑line switches or phar:// URIs are accepted.', 'Configure the web server to disable the phar wrapper (e.g., `php.ini` setting `phar.readonly = On`) to prevent execution of phar archives.', 'Consider running MISP under a dedicated, least‑privileged user and enforce strict file permissions to limit the impact of any potential RCE.', 'Regularly review and audit background job configurations and logs for anomalous activity.']

Risk context

The CVE is rated critical with a CVSS v3 score of 9.8, indicating a high likelihood of exploitation and severe impact. No EPSS data is available, but the deterministic nature of the flaw means that any exposed contact form or similar endpoint is immediately vulnerable. Prompt patching or mitigation is strongly recommended.

Affected products

  • MISP
  • MISP Community Edition
  • MISP Enterprise
  • MISP Docker
  • MISP API

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
5.1
EPSS
—

remote-code-execution cakephp background-job phar misp input-validation critical web-application

← All CVEs

Related CVEs

critical

CVE-2026-93134

In the Linux kernel, the following vulnerability has been resolved: printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock is released and the pointer to the console struct might now be invalid. Therefore, after calling nbcon_legacy_emit_next_record() or console_emit_next_record(), it is necessary to check if a handover occurred _before_ further @con usage. Sashiko pointed out that console_flush_one_record() was not doing this. In console_flush_one_record(), after emitting a record, move the further usage of @con after the handover check.

View analysis

critical

CVE-2026-91039

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as " / ", but that namespacing never takes effect. __connection_id__ is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose __connection_id__ is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space. This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.

View analysis

critical

CVE-2026-86341

CVE‑2026‑86341 is a critical access‑control flaw that allows an attacker to bypass deployment approval checks by disabling strict policies after a deployment object has been altered. The vulnerability can silently enable unapproved code changes to reach production, compromising the integrity of the deployment pipeline.

View analysis

critical

CVE-2026-91102

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

View analysis