Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

MISP admin can run code via crafted log path

CVE-2026-56446 · published 4 months ago
Summary

A site administrator in MISP can set the error log location to any file path. By pointing the log to a web‑accessible folder and inserting malicious data, an attacker with admin rights could place PHP code that the server would execute. Update MISP to the latest version, which limits log locations to safe directories and only allows non‑executable file names.

What to do
  • Update misp-project misp to version 2.5.42 or later.
Affected software
VendorProductAffected versions
misp-project misp < 2.5.42
cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*
Original advisory text
Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP
MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process.

The fix restricts log destinations to existing directories beneath APP/tmp/logs or /var/log, requires absolute paths, rejects stream wrappers and traversal-related input, and limits filenames to .log or .ndjson extensions while disallowing executable extension segments.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Sources
CVE-2026-56446 · NVD
CVE-2026-56446 · OSV
Track software like this
Free during beta