CVE-2026-93295 misp CVE debrief

Who should care

Defenders responsible for MISP deployments, web application security, and incident response should assess exposure and prioritize remediation. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-93295 is a high-severity vulnerability in MISP's background job dispatch mechanism, allowing remote code execution as the web user. Defenders should assess exposure, prioritize remediation, and implement compensating controls to prevent exploitation.

• Remote code execution in the context of the MISP web server process
• Potential data exfiltration and lateral movement within the host
• Need for validation and sanitization of user input for background job arguments
• Priority for applying patches or updates from the vendor

Technical summary

The MISP background job dispatch mechanism is vulnerable to remote code execution as the web user. An attacker can submit a crafted contact form to execute PHP code with the privileges of the web user. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. CakePHP's ShellDispatcher::_parsePaths() scans the entire argv for path switches and uses the following element as the application root. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code.

Defensive priority

High

Recommended defensive actions

• Review and restrict access to the events/contact form
• Validate and sanitize user input for background job arguments
• Monitor for suspicious activity and implement compensating controls
• Apply patches or updates from the vendor once available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in MISP's background job dispatch mechanism, allowing remote code execution as the web user. The vulnerability is caused by passing user-controlled fields into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.