CVE-2026-56446: MISP-Project MISP RCE Vulnerability

CVE-2026-56446 Overview

CVE-2026-56446 affects the Malware Information Sharing Platform (MISP), an open-source threat intelligence platform maintained by the MISP Project. The vulnerability allows a site administrator to configure an arbitrary filesystem path for the NDJSON error log written by JsonLogTool. Because log entries embed attacker-controlled content, an authenticated administrator can redirect log output to a PHP file under the web root and inject executable PHP through logged data. Retrieving the resulting file yields remote code execution under the web server account. The flaw maps to CWE-94: Improper Control of Generation of Code.

Critical Impact
An authenticated site administrator can achieve remote code execution as the web server user by writing attacker-controlled PHP into a web-accessible file via the NDJSON log path setting.

Affected Products

MISP (misp-project/misp) versions prior to the patched commit 9600d486
MISP instances exposing the JsonLogTool log path configuration
Deployments where the MISP web root is writable by the PHP process

Discovery Timeline

2026-06-22 - CVE-2026-56446 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56446

Vulnerability Analysis

The vulnerability resides in MISP's server configuration handler that accepts a user-supplied filesystem path for the NDJSON error log consumed by JsonLogTool. The application did not validate the path or restrict the filename extension. An authenticated site administrator could therefore point the log destination at any location the PHP process could write, including directories served by the web server.

Log records contain fields influenced by request input. By triggering log events that embed PHP tags within attacker-controlled strings, the adversary causes valid PHP source to be appended to the configured file. Requesting that file through the web server invokes the PHP interpreter and executes the injected payload.

The attack chain requires high privileges (site administrator) but no user interaction. Successful exploitation results in code execution with the privileges of the web server process, including read access to MISP's database credentials, API keys, and shared threat intelligence.

Root Cause

The Server model accepted any string for the log path setting without validating that the target directory was within an allow-listed location, that the path was absolute, or that the filename used a non-executable extension. Stream wrappers such as phar:// and php:// and .. traversal sequences were also accepted.

Attack Vector

A site administrator submits a crafted log path such as /var/www/MISP/app/webroot/img/orgs/shell.php through the server settings interface. Subsequent log writes append NDJSON records containing attacker-influenced fields. The adversary then issues an HTTP request to the resulting file under the webroot to execute the embedded PHP.

php

         return true;
     }
 
+    public function testLogPath($value)
+    {
+        // Controls where the ndjson error log is written (JsonLogTool). Those log
+        // lines can contain attacker-influenced content, so an unconstrained path
+        // is an RCE primitive (e.g. writing a *.php file under the webroot). We are
+        // therefore strict about BOTH the target directory and the file name.
+
+        // Empty is allowed: the logger falls back to its built-in default under
+        // APP/tmp/logs. On the save path the value already arrives trimmed.
+        if ($value === null || !is_string($value) || trim($value) === '') {
+            return true;
+        }
+        $value = trim($value);
+
+        // No NUL bytes, line breaks or stream wrappers (phar://, php://, ...).
+        if (strpos($value, "\0") !== false || preg_match('/[\r\n]/', $value) || strpos($value, '://') !== false) {
+            return 'Invalid characters in the log path.';
+        }
+
+        // Must be an absolute path.
+        if ($value[0] !== '/') {
+            return 'The log path must be an absolute path.';
+        }
+
+        // Resolve the parent directory so that symlinks and '..' traversal are
+        // collapsed before the allow-list check. The file need not exist yet, but
+        // its directory must (JsonLogTool does not create directories).

Source: MISP commit 9600d486 - patch adding the testLogPath validator.

Detection Methods for CVE-2026-56446

Indicators of Compromise

New or modified .php files appearing under MISP's app/webroot/ directory tree, especially with NDJSON-looking content interspersed with <?php tags
Changes to the MISP server setting controlling the JsonLogTool log path that point outside APP/tmp/logs or /var/log
HTTP requests from external clients to unexpected .php files under /img/, /files/, or other static asset paths
Outbound network connections initiated by the php-fpm or apache2 process to attacker-controlled infrastructure

Detection Strategies

Audit the MISP Server settings table and configuration backups for any log path value that does not resolve under APP/tmp/logs or /var/log
Compare deployed webroot file listings against the expected MISP distribution manifest to surface unauthorized PHP files
Inspect MISP audit logs for Server/serverSettingsEdit actions modifying the log path setting and correlate with the acting administrator account

Monitoring Recommendations

Enable file integrity monitoring on the MISP application directory, with priority on app/webroot/ and app/tmp/logs/
Forward web server access logs to a centralized analytics platform and alert on requests to newly created .php files
Alert on web server processes spawning shells (sh, bash, python) or making outbound connections inconsistent with MISP baseline behavior

How to Mitigate CVE-2026-56446

Immediate Actions Required

Update MISP to a release that includes commit 9600d486ccfc98388e13897fd954350cebac5fb0 or later
Review the current JsonLogTool log path setting and reset it to the default if it points outside APP/tmp/logs or /var/log
Rotate MISP API keys, database credentials, and administrator passwords if the setting was modified by an unexpected account
Inspect the webroot for unauthorized files and remove any artifacts produced through the log path primitive

Patch Information

The upstream fix is delivered in MISP commit 9600d486. The patch introduces the testLogPath validator in app/Model/Server.php, which requires an absolute path, rejects NUL bytes, line breaks, and stream wrappers (phar://, php://), resolves .. traversal before allow-list checks, restricts destinations to existing directories beneath APP/tmp/logs or /var/log, and limits filenames to .log or .ndjson while rejecting executable extension segments.

Workarounds

Restrict site administrator role assignments to a minimal set of trusted accounts and enforce multi-factor authentication for those users
Configure the web server to disallow PHP execution under writable directories such as app/tmp/, app/webroot/img/orgs/, and app/webroot/files/
Run the PHP process under a least-privileged account that cannot write to /var/log or the application webroot

bash

# Apache configuration: disable PHP execution under MISP writable paths
<Directory "/var/www/MISP/app/webroot/img">
    php_admin_flag engine off
    <FilesMatch "\.(php|phar|phtml)$">
        Require all denied
    </FilesMatch>
</Directory>

<Directory "/var/www/MISP/app/webroot/files">
    php_admin_flag engine off
    <FilesMatch "\.(php|phar|phtml)$">
        Require all denied
    </FilesMatch>
</Directory>