CVE-2026-95806
Deferred Deferred - Pending Action

Phar Deserialization and Arbitrary Code Execution in MISP

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CIRCL

Description
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.  The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:    - any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;  - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user. No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-95806
EUVD
EUVD-2026-84466

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2026-95806 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves MISP registering PHP's phar stream wrapper in both its web and console entry points. The wrapper causes PHP to treat phar archives as directories, leading to two security issues: filesystem operations on attacker-controlled paths trigger implicit unserialize() calls, creating deserialization sinks, and relocated applications can execute code inside uploaded phar files, enabling arbitrary code execution as the web user.

Detection Guidance

Check if the phar stream wrapper is registered in MISP's entry points by inspecting the web and console entry files for calls to stream_wrapper_unregister('phar'). If the wrapper is still registered, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system by uploading a malicious phar file and manipulating filesystem paths. This could allow them to take control of your MISP instance or access sensitive data, depending on the permissions of the web user.

Compliance Impact

This vulnerability could lead to unauthorized code execution and data breaches by allowing attackers to deserialize malicious payloads or execute arbitrary code via phar archives. This may violate GDPR's integrity and confidentiality requirements (Article 32) and HIPAA's security rule (45 CFR 164.308) by exposing personal or health data to compromise.

Mitigation Strategies

Apply the security fix by unregistering the phar stream wrapper in both the web and console entry points before the application boots up. This prevents exploitation via unserialize() sinks and arbitrary code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart