MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:
- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.
"}],"value":"MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. \n\nThe phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: \n\n - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;\n - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.\n\n\n\n\nNo component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument."}],"impacts":[{"capecId":"CAPEC-570","descriptions":[{"lang":"en","value":"CAPEC-570 Deserialization of Untrusted Data"}]},{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Leveraging Trusted Components in an Untrusted Environment"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-22T15:09:09.738Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/MISP/commit/08fa755b6"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The phar stream wrapper is unregistered via stream_wrapper_unregister('phar') at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments.
"}],"value":"The phar stream wrapper is unregistered via stream_wrapper_unregister('phar') at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments."}],"title":"MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The affected version range is inferred from the tag_version_boundary (v2.5.47, 42 commits after fix), suggesting the fix is included in v2.5.47 and earlier versions are affected. The explicit context lists affected_version and fixed_version as null, so the exact boundary is uncertain.","PR:L is assumed because MISP is an authenticated threat-intelligence platform; however, the patch does not explicitly state whether the vulnerable code path requires authentication. If the argument-injection vector is reachable unauthenticated, PR should be N.","AC:H is assumed because crafting a valid phar archive and identifying the correct code path for the filesystem call is non-trivial; the commit describes it as an 'argument-injection exploit,' implying specific conditions must be met.","The CAPEC-570 mapping is based on the commit message's explicit description of the phar wrapper as an 'unserialize() sink'; the exact MISP endpoint or console command that accepts the attacker-influenced path is not identified in the patch.","The commit message references 'the job-argument guard reverted,' implying a prior guard existed and was removed, making the phar wrapper the remaining defense. The exact prior guard is not described in this patch.","The Co-Authored-By line lists 'Claude Opus 5 (1M context)' as a co-author; this is recorded in the metadata as a remediation developer but is an AI assistant, not a human contributor. It is excluded from credits to avoid attributing a CVE credit to a non-human entity."],"capecRationale":[{"capecId":"CAPEC-570","rationale":"The core attack mechanism is that the phar stream wrapper turns a filesystem call on a caller-influenced path into an implicit unserialize() invocation. An attacker crafts a phar archive containing a malicious serialized payload and causes the application to perform a filesystem operation on that path, triggering deserialization and code execution. CAPEC-570 is the closest match. Uncertainty: the exact injection vector (which specific MISP endpoint or console command accepts the path) is not detailed in the patch, but the deserialization sink is explicitly described in the commit message."},{"capecId":"CAPEC-100","rationale":"The phar stream wrapper is a trusted, built-in PHP component that the attacker leverages in the MISP runtime environment where it serves no legitimate purpose. The attacker does not need to exploit a flaw in the wrapper itself; rather, its mere presence in the runtime provides the primitive. This is a secondary mapping; CAPEC-570 is preferred as the primary because it more precisely describes the deserialization mechanism."}],"commit":"08fa755b6363ec0b7194d97ea36800ae8eb8f919","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"iglocska"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: The vulnerability is reachable through the web entry point (app/webroot/index.php), making it network-accessible. AC:H: Exploitation requires crafting a valid phar archive with a malicious serialized payload and identifying a code path where a caller-influenced filesystem argument resolves to that archive; the commit describes this as an 'argument-injection exploit,' implying non-trivial path manipulation. AT:N: No specific attack-target conditions are indicated. PR:L: MISP is a threat-intelligence platform that typically requires authenticated access; the commit references 'the web user' context, suggesting the attacker operates within the application's privilege boundary. UI:N: No user interaction is required. VC/VI/VA:H: Successful exploitation results in arbitrary code execution as the web user, compromising confidentiality, integrity, and availability of the MISP instance. SC/SI/SA:N: No evidence of impact on subsequent or other components beyond the MISP instance itself.","fixSummary":"The phar stream wrapper is unregistered via stream_wrapper_unregister('phar') at the top of both the web and console entry points, before any framework bootstrap or application code executes. Because no MISP component, CakePHP, or runtime library requires the phar wrapper, removing it eliminates the implicit unserialize() sink and the directory-like phar archive behavior without functional impact. This closes the deserialization and code-execution primitive application-wide, independent of whether individual callers validate their path arguments.","generatedAt":"2026-09-22T15:01:21.211955Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"rankings":[{"agreementScore":9,"assumptionCount":6,"confidence":"medium","model":"qwen3.8:27b","score":4}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"f4fc3223e6421557e1c03c2182cfaa2b0c17a1a20870c71214708034faf1350f","patchSummary":"Two files are modified. In app/Console/cake.php and app/webroot/index.php, a 14-line block is inserted immediately after the file header comment and before any existing logic. The block checks whether 'phar' is present in stream_get_wrappers() and, if so, calls stream_wrapper_unregister('phar'). A docblock comment explains the security rationale: the wrapper turns filesystem calls on caller-influenced paths into unserialize() sinks and allows a relocated application root to reach code inside an uploaded file. No other code is changed; the total diff is 28 insertions across the two files.","patchTruncated":false,"patches":[{"commit":"08fa755b6363ec0b7194d97ea36800ae8eb8f919","patchSha256":"f4fc3223e6421557e1c03c2182cfaa2b0c17a1a20870c71214708034faf1350f","source":"https://github.com/MISP/MISP/commit/08fa755b6.patch","sourceUrl":"https://github.com/MISP/MISP/commit/08fa755b6.patch","subject":"chg: [internal] Unregister the phar stream wrapper in the"}],"source":"https://github.com/MISP/MISP/commit/08fa755b6.patch","subject":"chg: [internal] Unregister the phar stream wrapper in the","tagVersionBoundary":{"commits_after_fix":42,"repository":"https://github.com/MISP/MISP","tag":"v2.5.47","version":"2.5.47","version_type":"semver"},"weaknessRationale":[{"cweId":"CWE-502","rationale":"The phar stream wrapper causes PHP to invoke unserialize() implicitly whenever a filesystem operation resolves to a phar archive. An attacker who can influence the path argument (e.g., via argument injection) can supply a crafted phar file, triggering deserialization of attacker-controlled data and leading to code execution. This is the primary and most specific weakness."},{"cweId":"CWE-74","rationale":"The phar stream wrapper is a special element of the PHP runtime that was not neutralized (unregistered) in the MISP entry points. Its presence allows downstream filesystem calls to be subverted into deserialization sinks. This is a secondary, broader characterization of the same issue."}]}}},"recordType":"advisory","vulnId":"GCVE-1-2026-20263"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-95806","datePublished":"2026-09-22T15:09:09.738Z","dateReserved":"2026-09-22T15:09:04.977Z","dateUpdated":"2026-09-22T15:54:08.956Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-22 16:18:24","lastModifiedDate":"2026-09-22 16:18:24","problem_types":["CWE-74","CWE-502","CWE-502 CWE-502 Deserialization of Untrusted Data","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-22T15:53:57.690631Z","id":"CVE-2026-95806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"95806","Ordinal":"1","Title":"MISP: PHP phar stream wrapper enables deserialization and code e","CVE":"CVE-2026-95806","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"95806","Ordinal":"1","NoteData":"MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. \n\nThe phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: \n\n - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;\n - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.\n\n\n\n\nNo component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.","Type":"Description","Title":"MISP: PHP phar stream wrapper enables deserialization and code e"}]}}}