Executive brief
MISP, an open-source threat intelligence platform, contains a vulnerability that allows a site administrator to execute malicious code on the server. By manipulating log file settings, an attacker with administrative access can create a malicious file in a web-accessible folder. This could lead to a full takeover of the web server, potentially exposing sensitive threat data or disrupting operations.
Technical details
A code injection vulnerability (CWE-94) exists in MISP's JsonLogTool due to insufficient validation of the NDJSON error log path. An authenticated attacker with site administrator privileges can configure the log path to point to a web-accessible directory with a .php extension. By then triggering log entries that contain attacker-controlled content, the attacker can inject PHP code into the log file and execute it by accessing the file via the web server. The fix implements strict path validation, restricting logs to specific directories (APP/tmp/logs or /var/log), requiring absolute paths, and enforcing .log or .ndjson extensions.
Affected products
- MISP Project MISP <= 2.5.41
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory