CVE-2026-95806— MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
Quick assessment
Affected
MISP MISP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95806
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
Source: CVE Program / CVE List V5
Vulnerability Description
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:
- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;
- a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.
No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-95806
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95806
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-95806 (1)
Same Patch Batch · MISP · 2026-09-22 · 19 CVEs total
| CVE-2026-95658 | 6.9 MEDIUM | MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution o |
| CVE-2026-95754 | 6.9 MEDIUM | MISP: Disabled-user check ineffective in pre-authentication TOTP login branch |
| CVE-2026-95679 | 6.9 MEDIUM | MISP Unauthenticated Blind SSRF via XML Body Processing |
| CVE-2026-95667 | 6.9 MEDIUM | MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials |
| CVE-2026-95693 | 5.3 MEDIUM | MISP Information Disclosure via Forged Upload Path |
| CVE-2026-95805 | 5.3 MEDIUM | MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restric |
| CVE-2026-95698 | 5.3 MEDIUM | MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name |
| CVE-2026-95671 | 5.3 MEDIUM | MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collecti |
| CVE-2026-95685 | 5.3 MEDIUM | MISP Missing Authorization on replaceSuggestionInReport Event Report Action |
| CVE-2026-95674 | 5.3 MEDIUM | MISP EventsController queryEnrichment allows querying unavailable or legacy modules withou |
| CVE-2026-95683 | 5.3 MEDIUM | MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL |
| CVE-2026-95697 | 5.3 MEDIUM | MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Me |
| CVE-2026-95661 | 5.1 MEDIUM | MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type |
| CVE-2026-95665 | 5.1 MEDIUM | MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON |
| CVE-2026-95703 | 5.1 MEDIUM | MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_na |
| CVE-2026-95701 | 5.1 MEDIUM | MISP Path Traversal via Organization Name in Org-Statistics Logo Check |
| CVE-2026-95659 | 4.8 MEDIUM | MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread |
| CVE-2026-95682 | 4.8 MEDIUM | MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View |
IV. Related Vulnerabilities
Same product: MISP
-
CVE-2026-95805
MISP ACLComponent: Typo in previewEventAttributes ACL key by -
CVE-2026-95754
MISP: Disabled-user check ineffective in pre-authentication -
CVE-2026-95703
MISP OrganisationsController File Existence and Image-Type O -
CVE-2026-95701
MISP Path Traversal via Organization Name in Org-Statistics -
CVE-2026-95698
MISP Path Traversal in OrgImgHelper findOrgImage via Crafted
Same vendor: MISP
-
CVE-2026-95805
MISP ACLComponent: Typo in previewEventAttributes ACL key by -
CVE-2026-95754
MISP: Disabled-user check ineffective in pre-authentication -
CVE-2026-95703
MISP OrganisationsController File Existence and Image-Type O -
CVE-2026-95701
MISP Path Traversal via Organization Name in Org-Statistics -
CVE-2026-95698
MISP Path Traversal in OrgImgHelper findOrgImage via Crafted
Same weakness: CWE-502
-
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserializ -
CVE-2026-28325
SolarWinds Observability Self-Hosted Unauthenticated Remote -
CVE-2026-43642
Softaculous Virtualizor PHP Object Injection via Billing Mod -
CVE-2026-83803
Sentry: Unsafe pickle deserialization in Relocation Feature -
CVE-2026-65179
CVE-2026-65179
V. Comments for CVE-2026-95806
No comments yet