CVE-2026-95806: MISP Phar Stream Wrapper RCE Vulnerability

CVE-2026-95806 Overview

MISP registers PHP's phar stream wrapper in both its web entry point (app/webroot/index.php) and its console entry point (app/Console/cake.php). The wrapper causes PHP to treat a phar archive as a directory, creating two attack primitives. Any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call. A relocated application root can also reach executable code inside an uploaded phar file. Neither MISP, the vendored CakePHP framework, nor any runtime-loaded library reads or constructs phar archives, so the wrapper offers no legitimate function. This issue is tracked under [CWE-74] (improper neutralization of special elements in output used by a downstream component).

Critical Impact

An authenticated attacker who can influence a filesystem path argument can trigger PHP object deserialization or achieve arbitrary code execution as the web user.

Affected Products

• MISP (Malware Information Sharing Platform) web entry point
• MISP console entry point (cake.php)
• Deployments running affected MISP versions prior to commit 08fa755b6

Discovery Timeline

• 2026-09-22 - CVE CVE-2026-95806 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95806

Vulnerability Analysis

The vulnerability chains PHP's stream wrapper behavior with insecure deserialization. When the phar:// wrapper is registered, PHP metadata inside a phar archive is deserialized whenever a filesystem function operates on a path that resolves to that archive. Functions such as file_exists(), is_file(), filesize(), and directory operations become deserialization sinks. Additionally, if the MISP application root is relocated and points inside an uploaded file, PHP can execute code stored within that phar archive. Because MISP accepts file uploads and processes user-influenced paths in several code paths, the wrapper acts as a ready-made exploitation primitive for an authenticated attacker.

Root Cause

The root cause is the presence of PHP's phar stream wrapper in the runtime without any legitimate consumer. MISP, the vendored CakePHP framework, and its runtime-loaded libraries do not read or construct phar archives. Leaving the wrapper registered leaves an unused but dangerous primitive available to attackers who can influence a filesystem path argument or an application root path.

Attack Vector

Exploitation requires network access and low-privilege authentication to a MISP instance. An attacker uploads or plants a crafted phar archive, then coerces the application into performing a filesystem operation on a phar:// path referencing it. The metadata inside the archive is deserialized, invoking PHP magic methods on attacker-controlled objects. If a suitable gadget chain exists in MISP or CakePHP, this results in arbitrary code execution under the web server account.

// Patched entry points explicitly unregister the phar wrapper before
// any user-influenced code runs. Applied in both app/webroot/index.php
// and app/Console/cake.php.
/**
 * Drop the phar stream wrapper before anything else runs.
 *
 * Nothing in MISP, in the vendored CakePHP or in any library loaded at runtime
 * reads or builds a Phar - the wrapper only ever shows up as an attacker's
 * primitive. It makes an archive behave like a directory, which is how a
 * relocated application root reached code inside an uploaded file, and it turns
 * every filesystem call on a caller-influenced path into an unserialize() sink.
 * Removing it costs nothing here and closes both without relying on the callers.
 */
if (in_array('phar', stream_get_wrappers(), true)) {
    stream_wrapper_unregister('phar');
}

Source: MISP commit 08fa755b6

Detection Methods for CVE-2026-95806

Indicators of Compromise

• Uploaded files in MISP attachment or temporary directories with phar magic bytes or a __HALT_COMPILER(); marker inside otherwise benign-looking extensions (.jpg, .pdf, .txt).
• Web server or PHP-FPM processes spawning unexpected shells (sh, bash, python) as the MISP runtime user.
• Requests to MISP endpoints that pass user-controlled paths, followed by outbound connections initiated by the web worker.

Detection Strategies

• Inspect uploaded artifacts server-side for phar signatures rather than relying on file extension checks.
• Audit PHP application logs for phar:// occurrences in path arguments or in stack traces originating from filesystem functions.
• Monitor process lineage from the web server for anomalous child processes indicative of PHP code execution.

Monitoring Recommendations

• Alert on writes of executable payloads into MISP attachment, tmp, or export directories.
• Baseline outbound connections from the MISP host and flag deviations that follow authenticated file-handling requests.
• Centralize PHP error and access logs and query for phar://, unserialize, or unexpected include/require failures near upload timestamps.

How to Mitigate CVE-2026-95806

Immediate Actions Required

• Apply the upstream MISP commit 08fa755b6, which unregisters the phar stream wrapper in both entry points.
• Restrict MISP account provisioning and review authenticated users with permission to upload files or influence path parameters.
• Rotate credentials and API keys on any MISP instance where post-exploitation activity is suspected.

Patch Information

The fix is implemented in MISP commit 08fa755b6. Both app/webroot/index.php and app/Console/cake.php were modified to call stream_wrapper_unregister('phar') before any application code executes. Operators should upgrade to a MISP release that includes this commit.

Workarounds

• If patching is not immediately possible, add the stream_wrapper_unregister('phar') guard to both MISP entry points as shown in the upstream patch.
• Enforce strict validation of uploaded files, rejecting phar archives and any file whose contents contain a __HALT_COMPILER(); token.
• Restrict filesystem permissions so the web user cannot write to directories that are later referenced by relocated application roots or include paths.

# Verify the phar wrapper is no longer registered after applying the patch
php -r "var_dump(in_array('phar', stream_get_wrappers(), true));"
# Expected output: bool(false)

# Locate uploaded files whose contents indicate a phar archive
grep -rIl --binary-files=text '__HALT_COMPILER();' /var/www/MISP/app/tmp /var/www/MISP/app/files