CVE-2026-93295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93295", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-09-17T16:25:37.686Z", "datePublished": "2026-09-17T16:25:40.730Z", "dateUpdated": "2026-09-22T07:42:13.496Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["app/Controller/EventsController.php", "app/Lib/Tools/BackgroundJobsTool.php"], "product": "misp", "repo": "https://github.com/MISP/misp", "vendor": "misp", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "< 2.5.47", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Niels Teusink of Eye Security"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.&nbsp;</p><p>The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.</p>"}], "value": "MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u00a0\n\nThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host."}], "impacts": [{"capecId": "CAPEC-14", "descriptions": [{"lang": "en", "value": "CAPEC-14 Parameter Manipulation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-22T07:42:13.496Z"}, "references": [{"name": "Security patch", "tags": ["patch"], "url": "https://github.com/MISP/misp/commit/120813344"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.</p>"}], "value": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process."}], "source": {"discovery": "UNKNOWN"}, "title": "MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution", "x_gcve": [{"extensions": {"bcp-05-x-01": {"ai_annotations": [{"ai_level": "generated", "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "gna_source": 1, "models": [{"gna_source": 1, "identifier": "qwen3.8:27b", "name": "qwen3.8:27b", "source": "ollama"}], "review_status": "full", "scope": "record", "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"]}]}, "bcp-05-x-02": {"x_patch2vuln": {"assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 43 commits after fix); the exact first fixed release is not explicitly stated in the patch and may differ.", "PR:L assumes the events/contact endpoint requires at least a low-privilege authenticated session; if the endpoint is accessible without authentication in some MISP configurations, PR should be U (Unprivileged).", "The CAPEC-14 mapping is the closest available pattern; the attack is more specifically an argument injection into a framework dispatcher rather than generic parameter manipulation, but no CAPEC entry precisely describes this mechanism.", "The phar:// exploitation path assumes the target PHP process has the phar stream wrapper enabled and that the attacker can place or reference a crafted archive accessible via the phar:// URI; the patch does not explicitly confirm the phar wrapper is enabled by default.", "The commit date (17 Sep 2026) is in the future relative to typical CVE timelines; this is taken at face value from the patch metadata."], "capecRationale": [{"capecId": "CAPEC-14", "rationale": "The attacker manipulates the person and message parameters of the events/contact form to inject CakePHP console path switches into the background job argv. The parameters are modified so that the downstream console dispatcher interprets them as directives (setting the application root) rather than as data. This is the closest CAPEC pattern; the attack does not involve classic OS command injection (CAPEC-88) but rather argument injection into a framework-level dispatcher, making CAPEC-14 the best available match."}], "commit": "120813344f36b8fad15cd917e97b09fa3497156b", "confidence": "high", "credits": [{"lang": "en", "type": "reporter", "value": "Niels Teusink of Eye Security"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "cvssRationale": "AV:N: The contact endpoint is reachable over the network via HTTP. AC:L: The attack requires only crafting two form fields with a known switch string and a phar:// path; no race conditions or special timing. AT:N: No specific target configuration or state is required beyond a standard MISP installation. PR:L: The attacker needs a low-privilege authenticated MISP account with access to the event contact action. UI:N: No victim interaction is needed beyond the attacker's own form submission. VC:H, VI:H, VA:H: Successful exploitation results in arbitrary PHP code execution as the web user, giving full control over the MISP server's data, processes, and availability. SC:N, SI:N, SA:N: The impact is confined to the MISP server itself; no evidence of lateral impact on other systems.", "fixSummary": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.", "generatedAt": "2026-09-17T16:22:44.930762Z", "generator": "patch2vuln.py", "model": "qwen3.8:27b", "modelComparison": {"rankings": [{"agreementScore": 9, "assumptionCount": 5, "confidence": "high", "model": "qwen3.8:27b", "score": 6}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77", "patchSummary": "Three files are modified. In BackgroundJobsTool.php, a new RESERVED_ARGUMENTS constant lists the eight console path switches, and a new private validateArgs() method iterates over job arguments and throws InvalidArgumentException if any string argument exactly matches a reserved switch. The enqueue() method calls validateArgs() before dispatching. In EventsController.php, the person field assignment in contact() is changed from a raw value to (bool) cast. A new test file BackgroundJobsToolArgumentsTest.php verifies that ordinary arguments pass, free text merely containing a switch substring passes, every reserved switch is refused, and non-string arguments are unaffected.", "patchTruncated": false, "patches": [{"commit": "120813344f36b8fad15cd917e97b09fa3497156b", "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77", "source": "https://github.com/MISP/misp/commit/120813344.patch", "sourceUrl": "https://github.com/MISP/misp/commit/120813344.patch", "subject": "fix: [security] Refuse console path switches in background"}], "source": "https://github.com/MISP/misp/commit/120813344.patch", "subject": "fix: [security] Refuse console path switches in background", "tagVersionBoundary": {"commits_after_fix": 43, "repository": "https://github.com/MISP/misp", "tag": "v2.5.47", "version": "2.5.47", "version_type": "semver"}, "weaknessRationale": [{"cweId": "CWE-74", "rationale": "User-controlled form fields (person, message) are passed as arguments to a downstream component (the CakePHP console dispatcher) where special elements (path switches like -app, -root) are interpreted as directives rather than data. The lack of neutralization of these special elements in the job argument vector is the root cause."}, {"cweId": "CWE-20", "rationale": "The background job enqueue path accepted arbitrary string arguments without validating them against the set of values that the downstream console dispatcher interprets as control switches. The fix adds explicit validation to reject reserved argument values."}]}}}, "recordType": "advisory", "vulnId": "gcve-1-2026-20153"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T18:09:12.355251Z", "id": "CVE-2026-93295", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T18:09:27.142Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:09:12.355251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T18:09:23.341Z"}}], "cna": {"title": "MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution", "source": {"discovery": "UNKNOWN"}, "x_gcve": [{"vulnId": "gcve-1-2026-20153", "extensions": {"bcp-05-x-01": {"ai_annotations": [{"tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"], "scope": "record", "models": [{"name": "qwen3.8:27b", "source": "ollama", "gna_source": 1, "identifier": "qwen3.8:27b"}], "ai_level": "generated", "gna_source": 1, "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "review_status": "full"}]}, "bcp-05-x-02": {"x_patch2vuln": {"model": "qwen3.8:27b", "commit": "120813344f36b8fad15cd917e97b09fa3497156b", "source": "https://github.com/MISP/misp/commit/120813344.patch", "credits": [{"lang": "en", "type": "reporter", "value": "Niels Teusink of Eye Security"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "patches": [{"commit": "120813344f36b8fad15cd917e97b09fa3497156b", "source": "https://github.com/MISP/misp/commit/120813344.patch", "subject": "fix: [security] Refuse console path switches in background", "sourceUrl": "https://github.com/MISP/misp/commit/120813344.patch", "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77"}], "subject": "fix: [security] Refuse console path switches in background", "generator": "patch2vuln.py", "confidence": "high", "fixSummary": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.", "assumptions": ["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 43 commits after fix); the exact first fixed release is not explicitly stated in the patch and may differ.", "PR:L assumes the events/contact endpoint requires at least a low-privilege authenticated session; if the endpoint is accessible without authentication in some MISP configurations, PR should be U (Unprivileged).", "The CAPEC-14 mapping is the closest available pattern; the attack is more specifically an argument injection into a framework dispatcher rather than generic parameter manipulation, but no CAPEC entry precisely describes this mechanism.", "The phar:// exploitation path assumes the target PHP process has the phar stream wrapper enabled and that the attacker can place or reference a crafted archive accessible via the phar:// URI; the patch does not explicitly confirm the phar wrapper is enabled by default.", "The commit date (17 Sep 2026) is in the future relative to typical CVE timelines; this is taken at face value from the patch metadata."], "generatedAt": "2026-09-17T16:22:44.930762Z", "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77", "patchSummary": "Three files are modified. In BackgroundJobsTool.php, a new RESERVED_ARGUMENTS constant lists the eight console path switches, and a new private validateArgs() method iterates over job arguments and throws InvalidArgumentException if any string argument exactly matches a reserved switch. The enqueue() method calls validateArgs() before dispatching. In EventsController.php, the person field assignment in contact() is changed from a raw value to (bool) cast. A new test file BackgroundJobsToolArgumentsTest.php verifies that ordinary arguments pass, free text merely containing a switch substring passes, every reserved switch is refused, and non-string arguments are unaffected.", "cvssRationale": "AV:N: The contact endpoint is reachable over the network via HTTP. AC:L: The attack requires only crafting two form fields with a known switch string and a phar:// path; no race conditions or special timing. AT:N: No specific target configuration or state is required beyond a standard MISP installation. PR:L: The attacker needs a low-privilege authenticated MISP account with access to the event contact action. UI:N: No victim interaction is needed beyond the attacker's own form submission. VC:H, VI:H, VA:H: Successful exploitation results in arbitrary PHP code execution as the web user, giving full control over the MISP server's data, processes, and availability. SC:N, SI:N, SA:N: The impact is confined to the MISP server itself; no evidence of lateral impact on other systems.", "capecRationale": [{"capecId": "CAPEC-14", "rationale": "The attacker manipulates the person and message parameters of the events/contact form to inject CakePHP console path switches into the background job argv. The parameters are modified so that the downstream console dispatcher interprets them as directives (setting the application root) rather than as data. This is the closest CAPEC pattern; the attack does not involve classic OS command injection (CAPEC-88) but rather argument injection into a framework-level dispatcher, making CAPEC-14 the best available match."}], "patchTruncated": false, "modelComparison": {"rankings": [{"model": "qwen3.8:27b", "score": 6, "confidence": "high", "agreementScore": 9, "assumptionCount": 5}], "selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."}, "weaknessRationale": [{"cweId": "CWE-74", "rationale": "User-controlled form fields (person, message) are passed as arguments to a downstream component (the CakePHP console dispatcher) where special elements (path switches like -app, -root) are interpreted as directives rather than data. The lack of neutralization of these special elements in the job argument vector is the root cause."}, {"cweId": "CWE-20", "rationale": "The background job enqueue path accepted arbitrary string arguments without validating them against the set of values that the downstream console dispatcher interprets as control switches. The fix adds explicit validation to reject reserved argument values."}], "tagVersionBoundary": {"tag": "v2.5.47", "version": "2.5.47", "repository": "https://github.com/MISP/misp", "version_type": "semver", "commits_after_fix": 43}}}}, "recordType": "advisory"}], "credits": [{"lang": "en", "type": "reporter", "value": "Niels Teusink of Eye Security"}, {"lang": "en", "type": "remediation developer", "value": "iglocska"}, {"lang": "en", "type": "remediation developer", "value": "Claude Opus 5 (1M context)"}], "impacts": [{"capecId": "CAPEC-14", "descriptions": [{"lang": "en", "value": "CAPEC-14 Parameter Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/MISP/misp", "vendor": "misp", "modules": ["app/Controller/EventsController.php", "app/Lib/Tools/BackgroundJobsTool.php"], "product": "misp", "versions": [{"status": "affected", "version": "< 2.5.47", "lessThan": "2.5.47", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.", "supportingMedia": [{"type": "text/html", "value": "<p>The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.</p>", "base64": false}]}], "references": [{"url": "https://github.com/MISP/misp/commit/120813344", "name": "Security patch", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u00a0\n\nThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.", "supportingMedia": [{"type": "text/html", "value": "<p>MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.&nbsp;</p><p>The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-09-22T07:42:13.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93295", "state": "PUBLISHED", "dateUpdated": "2026-09-22T07:42:13.496Z", "dateReserved": "2026-09-17T16:25:37.686Z", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "datePublished": "2026-09-17T16:25:40.730Z", "assignerShortName": "CIRCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["app/Controller/EventsController.php", "app/Lib/Tools/BackgroundJobsTool.php"], "product": "misp", "repo": "https://github.com/MISP/misp", "vendor": "misp", "versions": [{"lessThan": "2.5.47", "status": "affected", "version": "< 2.5.47", "versionType": "semver"}]}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u00a0\n\nThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host."}], "id": "CVE-2026-93295", "lastModified": "2026-09-22T08:16:41.520", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93295", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T18:09:12.355251Z", "version": "2.0.3"}}]}, "published": "2026-09-17T17:18:17.053", "references": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "url": "https://github.com/MISP/misp/commit/120813344"}], "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-74"}], "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.47)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "misp", "source": "cna", "vendor": "misp"}, "product": "misp", "vendor": "misp"}], "created": "2026-09-18T14:30:09.513150+00:00", "updated": "2026-09-22T10:15:17.681100+00:00", "vendors": ["misp", "misp$PRODUCT$misp"]}