CVE-2026-95679
Deferred Deferred - Pending Action

XML External Entity Processing in MISP cspReport Endpoint

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes the https branch to bypass the readFile check entirely. As a result, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Because the cspReport endpoint accepts XML content type and is unauthenticated by design, an unauthenticated remote attacker can send a POST request with a crafted XML body to cause the MISP server to issue an outbound HTTPS request to an arbitrary target reachable from the server. The attacker does not receive the response body, but can use the vulnerability to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the server's network environment.  The vulnerability affects any MISP deployment where the cspReport endpoint is reachable and the server has network access to internal or external HTTPS services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95679
EUVD
EUVD-2026-84395

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
misp misp From 5a6e4751-2f3f-4070-9419-94fb35b644e8 (inc)
misp misp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in MISP's RequestHandlerComponent. It occurs because XML request bodies are automatically decoded on write requests, including unauthenticated endpoints like cspReport. A logic error in the Xml::build() library's readFile guard condition allows a bare HTTPS URL in the request body to bypass security checks and trigger the server to fetch external content. This enables unauthenticated attackers to force the server to make outbound HTTPS requests to arbitrary targets.

Detection Guidance

Check MISP logs for outbound HTTPS requests from the server originating from the cspReport endpoint. Monitor network traffic for unexpected HTTPS connections initiated by the MISP server. Inspect XML POST requests to the cspReport endpoint for bare HTTPS URLs in the request body.

Impact Analysis

An attacker can exploit this to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the server's network. While the attacker cannot see the response, they can map internal network structures, access restricted services, or potentially trigger unintended actions on behalf of the server.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection), HIPAA (health data security), or other regulations by enabling unauthorized network probing or data exfiltration attempts. It may violate requirements for network security controls, access restrictions, and data protection measures.

Mitigation Strategies

Apply the patch from the MISP GitHub commit 716fc49d3 immediately. Disable or restrict access to the cspReport endpoint if not required. Implement network-level controls to block outbound HTTPS requests from the MISP server to unauthorized destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart