CVE-2026-94401: MISP Path Traversal Vulnerability

CVE-2026-94401 Overview

CVE-2026-94401 is a file-handling vulnerability in Malware Information Sharing Platform (MISP) versions prior to 2.5.47. The flaw resides in the XML import routine, which fails to validate that uploaded content is an actual XML document. An authenticated user with modify permissions can submit a file containing a local file path or a URL instead of XML data. MISP then reads the referenced file or issues a request to the supplied address. The vulnerability is classified under CWE-73: External Control of File Name or Path.

Critical Impact
Authenticated attackers can read arbitrary files from the MISP server and pivot to internal network services through Server-Side Request Forgery (SSRF), exposing sensitive configuration data and reachable internal systems.

Affected Products

MISP (Malware Information Sharing Platform) versions earlier than 2.5.47
MISP instances that permit XML event import to authenticated users with modify permissions
Deployments where the MISP host has network reachability to internal services

Discovery Timeline

2026-09-21 - CVE-2026-94401 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in the NVD database

Technical Details for CVE-2026-94401

Vulnerability Analysis

The vulnerability affects MISP's event import handler in app/Model/Event.php. When the import flag $isXml is set, MISP passes uploaded content directly to Xml::build() from CakePHP's XML utility. The utility interprets the input as either a document, a filesystem path, or a URL depending on its shape. Because MISP did not first confirm the payload was XML markup, an attacker could substitute a locator such as /etc/passwd or http://10.0.0.1/. The server then either read the local file into the import parser or issued an HTTP/HTTPS request to the specified endpoint. An existing readFile guard inside CakePHP was bypassed for the HTTPS branch due to an operator precedence bug.

Root Cause

The root cause is missing input validation on the XML upload path. Xml::build() is polymorphic and accepts strings, file paths, and URLs interchangeably. Without a preflight check for XML markup, the function's built-in filesystem and network fetch behavior became reachable from the import endpoint.

Attack Vector

Exploitation requires a valid MISP account with permission to modify data. No additional user interaction is needed. The attacker uploads a crafted event file through the XML import interface, supplying either a filesystem path or an internal URL. The server then dereferences the locator, returning file contents into the import pipeline or performing an outbound request to internal resources such as cloud metadata endpoints, admin panels, or unauthenticated intranet APIs.

php

// Security patch in app/Model/Event.php
// Refuses uploads whose content is a path or URL instead of an XML document

        if ($isXml) {
            App::uses('Xml', 'Utility');
-           $dataArray = Xml::toArray(Xml::build($data));
+           // The uploaded file's *content* is a document, never a locator.
+           // Xml::build() would otherwise treat a body of `/etc/passwd` or
+           // `http://10.0.0.1/` as something to read or fetch and then import,
+           // and its readFile guard does not cover the https branch (operator
+           // precedence). Refuse anything that is not a document first.
+           if (strpos($data, '<') === false) {
+               throw new Exception("File does not contain an XML document");
+           }
+           $dataArray = Xml::toArray(Xml::build($data, ['readFile' => false]));
        } else {
            $dataArray = $this->jsonDecode($data);
            if (isset($dataArray['response'][0])) {

Source: MISP Security Commit d5f247b91

Detection Methods for CVE-2026-94401

Indicators of Compromise

Event import requests containing bodies that resemble filesystem paths (for example /etc/passwd, /proc/self/environ) rather than XML markup.
Import payloads beginning with http://, https://, or file:// schemes instead of an XML opening tag.
Outbound HTTP connections from the MISP application server to internal RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254.
Application error entries referencing Xml::build() parse failures immediately followed by successful file reads.

Detection Strategies

Inspect MISP web server access logs for POST requests to event import endpoints and correlate with unusually small request bodies lacking XML markers.
Monitor host-level file access telemetry for reads of sensitive files performed by the PHP-FPM or Apache worker processes handling MISP.
Deploy egress network monitoring to flag outbound requests from the MISP server to unexpected internal destinations.

Monitoring Recommendations

Enable verbose audit logging in MISP for all event import actions and retain logs for correlation with authentication events.
Alert on any authenticated MISP user whose activity pattern shifts toward repeated failed XML imports followed by policy changes.
Track MISP server outbound DNS queries for internal-only hostnames that should never resolve from that host.

How to Mitigate CVE-2026-94401

Immediate Actions Required

Upgrade MISP to version 2.5.47 or later, which applies the input validation fix committed in d5f247b91.
Audit MISP user accounts and revoke modify permissions from any account that does not require event creation capability.
Rotate credentials and API tokens for services reachable from the MISP host if evidence of exploitation is found in logs.

Patch Information

The fix is applied in app/Model/Event.php and rejects any upload whose content does not contain a < character before invoking Xml::build(). The patched call also passes ['readFile' => false] to disable the filesystem and URL fetch behavior of the CakePHP XML utility. Review the MISP Security Commit d5f247b91 for the complete change set.

Workarounds

Restrict the MISP application's network egress using host firewall rules so it cannot reach internal management interfaces or cloud metadata services.
Run the MISP web process under a dedicated low-privilege account with filesystem access limited to the MISP installation directory.
Temporarily disable XML event import for non-administrator roles until the patch is applied.

bash

# Example egress restriction using iptables on the MISP host
# Block outbound access to RFC1918 ranges and cloud metadata endpoint
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT