CVE-2026-93295 in MISP
Summary
by MITRE • 09/17/2026
MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Management Information Sharing Platform (MISP) represents a critical security flaw rooted in improper input validation and unsafe command construction within its background job dispatch mechanism. This issue specifically affects how user-supplied data is processed when triggering asynchronous tasks, leading to a direct path for remote code execution. The core of the problem lies in the interaction between MISP’s event handling logic and the underlying CakePHP framework's console dispatcher. When an authenticated user submits specific forms that trigger background jobs, such as the events/contact endpoint, the system passes arguments directly into the argument vector (argv) of a CakePHP ShellDispatcher process without adequate sanitization or validation against reserved command-line switches. This design oversight allows an attacker to manipulate the execution context by injecting malicious parameters that are interpreted not just as data but as operational directives for the application framework itself.
The technical mechanism exploits how CakePHP's ShellDispatcher::_parsePaths() function processes incoming arguments. This internal method scans the entire argv array looking for specific path-related switches such as -app, --app, -working, --working, -root, --root, -webroot, and --webroot to determine the application root directory. In a secure implementation, user-supplied data intended for business logic should never be treated as potential command-line flags or configuration paths. However, in this vulnerable scenario, fields like person and message from the contact form are passed directly into these job arguments without filtering out characters that could mimic reserved switches. By setting the person field to a value matching one of these reserved switches, such as -app, and configuring the message field with a specially crafted payload, an attacker can hijack the application's initialization sequence. The system interprets the user input as a directive to change the working directory or root path, effectively redirecting where it looks for configuration files.
The exploitation chain culminates in remote code execution through the use of PHP Archive (phar://) wrappers. Once the victim server processes the crafted request and attempts to load its configuration from the location specified by the injected switch, an attacker can point this location to a malicious PHAR archive hosted on their own infrastructure or embedded within the payload itself. When CakePHP's bootstrap process includes Config/core.php from this arbitrary path, it inadvertently executes PHP code contained within that file. Since the background jobs run with the privileges of the web server user (typically www-data or apache), the executed code inherits these permissions. This results in full remote code execution on the host system without requiring any special timing conditions, race conditions, or complex exploitation techniques; the attack is deterministic and reliable once the crafted parameters are accepted by the application logic.
The operational impact of this vulnerability is severe, granting an attacker complete control over the MISP web server process. With access to the underlying operating system at the level of the web user, an adversary can exfiltrate sensitive intelligence data stored within the platform, establish persistence mechanisms for long-term access, and perform lateral movement across the internal network if the web server is compromised further or has elevated privileges through misconfiguration. This undermines the integrity and confidentiality guarantees that MISP provides to its users in threat intelligence sharing communities. The ability to execute arbitrary code means that attackers can modify logs, install backdoors, or pivot to other systems connected to the same network segment, significantly expanding the blast radius of a single initial access point.
Mitigation strategies must focus on strict input validation and secure coding practices within the background job dispatching layer. Developers should implement allow-lists for any parameters passed into system commands or framework-specific argument vectors, ensuring that user-supplied data cannot be interpreted as command-line flags or file paths. Specifically, fields like person and message in contact forms should undergo rigorous sanitization to strip out characters such as hyphens or double-hyphens that could trigger switch parsing logic. Additionally, the application should avoid passing raw user input directly into argv structures used by framework dispatchers. Instead, data should be serialized securely and passed via standard means like database records or message queues where it is decoupled from execution contexts. Updating to a patched version of MISP that addresses this specific flaw in the ShellDispatcher interaction is essential for immediate remediation. Furthermore, implementing principle of least privilege by restricting web server permissions can limit the potential damage even if an exploitation attempt succeeds.