Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-93295— MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

Quick assessment

Affected
misp misp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP 的背景任务分发机制中存在一个漏洞，允许以 Web 用户身份执行远程代码。背景任务的参数会直接作为 CakePHP 控制台进程的 传入。CakePHP 的 方法会扫描整个 中的路径相关参数（如 、 、 、 、 、 、 、 ），并将后续元素用作应用程序根目录。 接口会将用户可控的字段（ 和 ）未经校验地传入任务参数。攻击者只需提交联系表单，即可将 字段设为保留开关（例如 ），并将 字段设为指向恶意归档文件的 URI。随后，CakePHP 引导程序会从该归档文件中包含 ，从而执行攻击者控制的 PHP 代码，其权

CVSS 5.1 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93295

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution
Source: CVE Program / CVE List V5
Vulnerability Description
MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
misp misp < 2.5.47 ~ 2.5.47 -

II. Public POCs for CVE-2026-93295

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93295

请登录查看更多情报信息。

Other References for CVE-2026-93295 (1)

Same Patch Batch · misp · 2026-09-17 · 3 CVEs total

CVE-2026-92932 5.1 MEDIUM MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF W
CVE-2026-93296 5.1 MEDIUM MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legend

IV. Related Vulnerabilities

Same product: misp
Same vendor: misp
Same weakness: CWE-74

V. Comments for CVE-2026-93295

No comments yet

Leave a comment