Vulnerability · Published Sep 22, 2026 · Assigned by CIRCL
CVE-2026-95806MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
High 7.7
In plain English
A high-severity unsafe deserialization in MISP from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink; - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user. No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
Affected products (as reported)
Weakness: CWE-502, CWE-74 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- Security patch patch