CVE-2026-95679 in MISP
Summary
by MITRE • 09/22/2026
MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes the https branch to bypass the readFile check entirely. As a result, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Because the cspReport endpoint accepts XML content type and is unauthenticated by design, an unauthenticated remote attacker can send a POST request with a crafted XML body to cause the MISP server to issue an outbound HTTPS request to an arbitrary target reachable from the server.
The attacker does not receive the response body, but can use the vulnerability to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the server's network environment.
The vulnerability affects any MISP deployment where the cspReport endpoint is reachable and the server has network access to internal or external HTTPS services.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
MISP, a widely deployed open-source platform for sharing cyber threat intelligence, contains a critical server-side request forgery vulnerability within its RequestHandlerComponent. This component is responsible for processing incoming HTTP requests, specifically handling XML payloads through the Xml::build() library function. The core technical flaw stems from a logic error in the guard condition designed to prevent file inclusion attacks. Specifically, the code checks if the input should be treated as a file path or a URL using an expression that evaluates readFile and http or https conditions. Due to PHP operator precedence rules, this logical structure is parsed incorrectly, causing the check for valid HTTP or HTTPS URLs to bypass the safeguard intended to restrict access to local files when specific flags are set. Consequently, any string containing a bare HTTPS URL within the request body is erroneously interpreted as a remote locator rather than being rejected or treated as raw data.
This architectural weakness allows an unauthenticated attacker to exploit the cspReport endpoint, which by design accepts XML content types and does not require authentication for its primary function of receiving Content Security Policy reports from browsers. By sending a POST request with a crafted XML body containing a malicious HTTPS URL, the attacker can force the MISP server to initiate an outbound connection to any target reachable from the network environment where the application is hosted. Although the vulnerability does not allow the attacker to directly read or exfiltrate the response body of these forged requests due to how the Xml library handles the output, it effectively creates a blind Server-Side Request Forgery (SSRF) vector. This capability transforms the MISP instance into an active proxy for network reconnaissance and internal service probing.
The operational impact of this vulnerability is significant in environments where MISP servers have access to internal networks or sensitive external services. Attackers can leverage this flaw to probe internal infrastructure, identifying live hosts, open ports, and running services that are not exposed to the public internet. Furthermore, because many modern web applications rely on specific HTTP methods for state-changing operations, an attacker could potentially trigger actions on internal HTTPS endpoints if those endpoints do not strictly validate request origins or require additional authentication tokens beyond what is present in a standard POST request. This enables timing-based reconnaissance, where variations in response times from the target service can reveal information about its availability and configuration without directly exposing data to the external attacker.
From a classification perspective, this vulnerability aligns with CWE-918, which addresses Server-Side Request Forgery (SSRF) flaws resulting from improper validation of user-supplied input used as URLs or file paths. It also maps to MITRE ATT&CK technique T1571, specifically the Proxy protocol usage for covert command and control channels or reconnaissance activities. The lack of authentication on the cspReport endpoint exacerbates the risk, as it removes a critical layer of defense that would otherwise limit exploitation to authenticated users only. This design choice prioritizes ease of integration with browser-based CSP reporting mechanisms over strict access control, inadvertently creating an open door for remote attackers.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective short-term fix is to patch the Xml::build() logic error by explicitly enforcing operator precedence using parentheses or refactoring the conditional statement to ensure that URL validation occurs before any file system checks are bypassed. Additionally, developers should implement strict input validation on all XML fields to reject unexpected data types and enforce allowlists for permitted outbound connections if possible. For organizations unable to immediately patch, network-level controls such as firewall rules restricting egress traffic from the MISP server IP address can significantly reduce the attack surface by preventing access to internal subnets or sensitive external endpoints. Regular security audits of endpoint authentication requirements are also recommended to ensure that no critical functionality remains exposed without proper authorization mechanisms in place.