Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92932— MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

Quick assessment

Affected
misp sachertortephp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 MISP 的 库中， 中的 静态方法存在一个逻辑错误，该错误位于控制基于网络的 XML 获取的条件判断中。原始条件被编写为： 。由于 PHP 中 运算符的优先级高于 ，该表达式实际被解析为 。因此，当调用方显式将 选项设置为 以禁用文件和 URL 读取时，任何以 开头的输入字符串仍能满足该条件，从而通过 触发一次网络请求（该套接字被配置为最多跟随 10 次重定向）。 分支正确受 标志控制，但 分支未受控制。 因此，任何能够影响传入 的 参数的攻击者，都可以强制应用程序向攻击者可控的或内部的 URL 发起出站 H

CVSS 5.1 · Medium

Possible ATT&CK Techniques 1 AI

T1071.001 · Web Protocols
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92932

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
Source: CVE Program / CVE List V5
Vulnerability Description
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
misp sachertortephp 0 ~ 1c2da20cbe3f1e2a91458fe9a017823b7273fdac -

II. Public POCs for CVE-2026-92932

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92932

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-92932 (1)

IV. Related Vulnerabilities

Same vendor: misp
Same weakness: CWE-918

V. Comments for CVE-2026-92932

No comments yet

Leave a comment