MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.
"}],"value":"MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host."}],"impacts":[{"capecId":"CAPEC-14","descriptions":[{"lang":"en","value":"CAPEC-14 Parameter Manipulation"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-17T16:25:40.730Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/misp/commit/120813344"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.
"}],"value":"The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process."}],"title":"MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 43 commits after fix); the exact first fixed release is not explicitly stated in the patch and may differ.","PR:L assumes the events/contact endpoint requires at least a low-privilege authenticated session; if the endpoint is accessible without authentication in some MISP configurations, PR should be U (Unprivileged).","The CAPEC-14 mapping is the closest available pattern; the attack is more specifically an argument injection into a framework dispatcher rather than generic parameter manipulation, but no CAPEC entry precisely describes this mechanism.","The phar:// exploitation path assumes the target PHP process has the phar stream wrapper enabled and that the attacker can place or reference a crafted archive accessible via the phar:// URI; the patch does not explicitly confirm the phar wrapper is enabled by default.","The commit date (17 Sep 2026) is in the future relative to typical CVE timelines; this is taken at face value from the patch metadata."],"capecRationale":[{"capecId":"CAPEC-14","rationale":"The attacker manipulates the person and message parameters of the events/contact form to inject CakePHP console path switches into the background job argv. The parameters are modified so that the downstream console dispatcher interprets them as directives (setting the application root) rather than as data. This is the closest CAPEC pattern; the attack does not involve classic OS command injection (CAPEC-88) but rather argument injection into a framework-level dispatcher, making CAPEC-14 the best available match."}],"commit":"120813344f36b8fad15cd917e97b09fa3497156b","confidence":"high","credits":[{"lang":"en","type":"reporter","value":"Niels Teusink of Eye Security"},{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: The attack is delivered over the network via an HTTP form submission to the events/contact endpoint. AC:L: The attack requires no special conditions; the attacker simply crafts two form fields with specific values. AT:N: No special conditions or privileged access beyond normal authenticated use are needed. PR:L: The attacker needs a low-privilege authenticated MISP account capable of submitting the contact form (the endpoint is in EventsController and MISP typically requires authentication). UI:N: No user interaction is required beyond the attacker's own form submission. VC:H, VI:H, VA:H: Successful exploitation yields arbitrary PHP code execution as the web user, granting full read, write, and availability impact on the MISP host. SC:N, SI:N, SA:N: No evidence of impact on subsequent or other components beyond the vulnerable MISP instance.","fixSummary":"The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.","generatedAt":"2026-09-17T16:22:44.930762Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":5,"confidence":"high","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77","patchSummary":"Three files are modified. In BackgroundJobsTool.php, a new RESERVED_ARGUMENTS constant lists the eight console path switches, and a new private validateArgs() method iterates over job arguments and throws InvalidArgumentException if any string argument exactly matches a reserved switch. The enqueue() method calls validateArgs() before dispatching. In EventsController.php, the person field assignment in contact() is changed from a raw value to (bool) cast. A new test file BackgroundJobsToolArgumentsTest.php verifies that ordinary arguments pass, free text merely containing a switch substring passes, every reserved switch is refused, and non-string arguments are unaffected.","patchTruncated":false,"patches":[{"commit":"120813344f36b8fad15cd917e97b09fa3497156b","patchSha256":"8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77","source":"https://github.com/MISP/misp/commit/120813344.patch","sourceUrl":"https://github.com/MISP/misp/commit/120813344.patch","subject":"fix: [security] Refuse console path switches in background"}],"source":"https://github.com/MISP/misp/commit/120813344.patch","subject":"fix: [security] Refuse console path switches in background","tagVersionBoundary":{"commits_after_fix":43,"repository":"https://github.com/MISP/misp","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-74","rationale":"User-controlled form fields (person, message) are passed as arguments to a downstream component (the CakePHP console dispatcher) where special elements (path switches like -app, -root) are interpreted as directives rather than data. The lack of neutralization of these special elements in the job argument vector is the root cause."},{"cweId":"CWE-20","rationale":"The background job enqueue path accepted arbitrary string arguments without validating them against the set of values that the downstream console dispatcher interprets as control switches. The fix adds explicit validation to reject reserved argument values."}]}}},"recordType":"advisory","vulnId":"gcve-1-2026-20153"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-93295","datePublished":"2026-09-17T16:25:40.730Z","dateReserved":"2026-09-17T16:25:37.686Z","dateUpdated":"2026-09-17T18:09:27.142Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:18:17","lastModifiedDate":"2026-09-17 19:17:07","problem_types":["CWE-20","CWE-74","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-17T18:09:12.355251Z","id":"CVE-2026-93295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"93295","Ordinal":"1","Title":"MISP Background Job Argument Injection via Console Path Switches","CVE":"CVE-2026-93295","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"93295","Ordinal":"1","NoteData":"MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch (e.g., -app) and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user. The vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.","Type":"Description","Title":"MISP Background Job Argument Injection via Console Path Switches"}]}}}