Executive brief
MISP is an open-source threat intelligence platform used to collect, store, and share malware indicators and attack information across organizations. This vulnerability allows an attacker who can submit the events/contact form to execute arbitrary code as the web server user, enabling data theft, system compromise, and lateral movement within the organization's infrastructure.
Technical details
The vulnerability is a remote code execution flaw in MISP's background job dispatch mechanism. User-controlled input (the "message" and "person" fields from the events/contact endpoint) is passed directly as argv arguments to CakePHP's console process without validation. CakePHP's ShellDispatcher::_parsePaths() scans argv for reserved path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. An attacker can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive; CakePHP's bootstrap then includes Config/core.php from that archive, executing arbitrary PHP code with web server privileges. The attack requires only the ability to submit the contact form and is deterministic (no race conditions or special timing needed). A patch was released in commit 120813344 that validates job arguments and casts the person field to a boolean.
Affected products
- MISP Project MISP affected versions prior to commit 120813344
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Patch released in commit 120813344