CVE-2026-92932 in sachertortephp
Summary
by MITRE • 09/17/2026
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The MISP application, specifically within its integration of the CakePHP framework's XML utility library, contains a critical logic error in the Xml::build static method located at lib/Cake/Utility/Xml.php. This vulnerability stems from an incorrect implementation of conditional logic designed to control whether external resources are fetched via network requests or read locally from the file system. The core issue lies in how PHP operator precedence is handled within the validation check that determines if a given input string represents a remote URL requiring HTTP fetching. When developers intend to restrict XML parsing to local files only, they typically pass an option array with readFile set to false. However, due to a flawed boolean expression structure, this safeguard fails for HTTPS URLs, allowing unauthorized network access even when explicitly disabled by the application logic calling the method.
The technical root cause is a classic operator precedence mistake in PHP code. The original conditional statement was written as $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. In PHP, the logical AND operator has higher precedence than the logical OR operator. Consequently, the expression is parsed by the interpreter as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. This means that while access to HTTP URLs is correctly gated behind the readFile flag, access to HTTPS URLs bypasses this check entirely because the second part of the OR condition stands alone without any restriction on the readFile option. If an input string begins with https://, the entire expression evaluates to true regardless of whether $options['readFile'] is false or not, thereby triggering a network fetch via HttpSocket which can follow up to ten redirects.
This flaw results in a Server-Side Request Forgery vulnerability classified under CWE-918. By manipulating the input parameter passed to Xml::build(), an attacker who has control over XML data processed by MISP can force the server to initiate outbound HTTPS requests to arbitrary destinations. Since HttpSocket is configured to follow redirects, this capability significantly expands the attack surface, allowing attackers to probe internal network services that may not be directly accessible from the internet or to interact with external malicious endpoints for command and control purposes. The fetched XML response is then parsed and potentially returned to the caller, facilitating information disclosure of sensitive data hosted on internal servers such as metadata service instances, database interfaces, or administrative panels within the organization's infrastructure.
The operational impact of this vulnerability includes unauthorized network access from the server context, leading to potential exposure of confidential internal system information. Attackers can leverage this flaw to map internal networks, extract credentials stored in accessible endpoints, or pivot further into protected environments by exploiting trust relationships between services. This aligns with ATT&CK techniques related to Server-Side Request Forgery and Network Service Scanning, as it allows an adversary to use the compromised application server as a proxy for reconnaissance and data exfiltration from internal resources that would otherwise remain isolated from direct external access.
Mitigation strategies must address both immediate code fixes and broader architectural controls. The primary remediation involves correcting the boolean logic in lib/Cake/Utility/Xml.php by ensuring that both HTTP and HTTPS checks are properly gated by the readFile option, such as using parentheses to enforce correct precedence: $options['readFile'] && (strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0). Additionally, organizations should implement strict input validation for XML sources, disable external entity processing where not required, and configure HttpSocket with stricter redirect policies or IP allowlists to limit the scope of potential SSRF exploitation. Regular security audits focusing on operator precedence errors in conditional statements are recommended to prevent similar logic flaws in other parts of the codebase.