CVE-2026-94383: MISP Blocklist Module RCE Vulnerability

CVE-2026-94383 Overview

CVE-2026-94383 is an arbitrary code execution vulnerability in the Malware Information Sharing Platform (MISP) blocklist workflow module. The module accepts a user-supplied blocklist filename parameter and applies only basename() sanitization plus an empty-value check. It does not validate the file extension. A site administrator can write a file with any extension into the MISP export directory. If the web server is configured to execute scripts from that directory, the file runs in the context of the web server process. The flaw is classified under [CWE-20: Improper Input Validation] and affects MISP versions prior to 2.5.47.

Critical Impact

Successful exploitation yields arbitrary script execution as the web server user, resulting in full compromise of the MISP instance's confidentiality, integrity, and availability.

Affected Products

• MISP versions prior to 2.5.47
• MISP blocklist workflow module (Module_blocklist_action.php)
• MISP export directory when served by a script-executing web server

Discovery Timeline

• 2026-09-21 - CVE-2026-94383 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94383

Vulnerability Analysis

The MISP blocklist workflow module writes files to the MISP export directory using a filename derived from the blocklist.value workflow parameter. The code path applies basename() to strip directory components and rejects empty, ., and .. values. It performs no extension allowlisting. An authenticated site administrator can therefore submit a filename such as pwn.php and cause a PHP source file to be written into a directory that Apache or Nginx may serve. Requesting that file over HTTP triggers the PHP interpreter, executing attacker-controlled code as the web server user. Because MISP typically runs behind a PHP-enabled web server, this input validation gap converts a file-write primitive into a full remote code execution primitive.

Root Cause

The sanitization logic in app/Model/WorkflowModules/action/Module_blocklist_action.php never checks the extension returned by pathinfo(). Any string surviving basename() is treated as a valid blocklist filename, allowing scripting extensions such as .php, .phtml, or .phar to reach the export directory.

Attack Vector

Exploitation requires site-administrator privileges within MISP and network access to the workflow subsystem. The attacker triggers the blocklist workflow action with a crafted blocklist.value parameter pointing to a filename with a scripting extension. The workflow writes attacker-controlled content to the export directory. The attacker then issues an HTTP request to the resulting URL to execute the script.

// Patch: app/Model/WorkflowModules/action/Module_blocklist_action.php
// Strip path component, keep the resolved file in export dir.
$blocklistFilename = basename((string)($params['blocklist']['value'] ?? ''));
$allowedExtensions = ['txt', 'list', 'blocklist', 'csv'];
$extension = pathinfo($blocklistFilename, PATHINFO_EXTENSION);
if (!in_array($extension, $allowedExtensions, true)) {
    return $this->__fail(__('Blocklist filename has an invalid extension.'), $errors, $roamingData);
}
if ($blocklistFilename === '' || $blocklistFilename === '.' || $blocklistFilename === '..') {
    return $this->__fail(__('Blocklist filename is empty or invalid.'), $errors, $roamingData);
}

Source: MISP commit e5a943178

Detection Methods for CVE-2026-94383

Indicators of Compromise

• New files in the MISP export directory with executable extensions such as .php, .phtml, .phar, .pl, or .jsp.
• Workflow audit log entries that reference the blocklist action with a blocklist.value parameter containing a non-allowlisted extension.
• Web server access log entries requesting files from the MISP export path immediately after workflow execution by a site-administrator account.

Detection Strategies

• Compare filenames written to the export directory against the allowlist txt, list, blocklist, csv and alert on deviations.
• Correlate MISP workflow execution events with subsequent HTTP GET requests to the export directory from external sources.
• Monitor for child processes spawned by the web server user (www-data, apache, nginx) that are inconsistent with normal MISP operation.

Monitoring Recommendations

• Enable and forward MISP application logs, web server access logs, and workflow module logs to a central analytics platform.
• Alert on any site-administrator account modifying workflow module parameters, given the sensitivity of the role.
• Baseline process execution on the MISP host and flag interpreter processes (php, sh, python) invoked from web server contexts.

How to Mitigate CVE-2026-94383

Immediate Actions Required

• Upgrade MISP to version 2.5.47 or later, which enforces the extension allowlist.
• Audit existing files in the MISP export directory and remove any file with a scripting extension.
• Review the site-administrator account inventory and revoke unnecessary privileges, since the vulnerability requires that role.
• Rotate credentials, API keys, and secrets accessible to the web server process if compromise is suspected.

Patch Information

The fix is delivered in MISP commit e5a943178. The patch adds pathinfo() extension extraction and rejects any filename whose extension is not in the allowlist ['txt', 'list', 'blocklist', 'csv']. Upgrading to MISP 2.5.47 or later applies this validation.

Workarounds

• Configure the web server to disable script execution within the MISP export directory using php_admin_flag engine off in Apache or an equivalent Nginx location block that only serves static content.
• Restrict access to the blocklist workflow module by limiting site-administrator role assignments to a minimal, audited set of accounts.
• Apply filesystem monitoring to the MISP export directory and block writes of executable extensions at the operating system level using tools such as auditd or AppArmor.

# Nginx: disable script execution in the MISP export directory
location ^~ /app/webroot/files/ {
    default_type text/plain;
    types { }
    autoindex off;
}

# Apache: disable PHP handler in export directory
<Directory "/var/www/MISP/app/webroot/files">
    php_admin_flag engine off
    SetHandler none
    Options -ExecCGI
</Directory>