https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:43:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373688 EUVD-2026-373688 https://cve.radiocsirt.org/vuln/euvd-2026-373688 https://cve.radiocsirt.org/vuln/fkie_cve-2026-95806 <p>MISP ships with PHP&#39;s phar stream wrapper registered in both its web entry point and its console entry point.</p> <p>The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:</p> <p>- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;  - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.</p> <p>No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.</p> <p>MISP ships with PHP&#39;s phar stream wrapper registered in both its web entry point and its console entry point.</p> <p>The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:</p> <p>- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;  - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.</p> <p>No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-95806 https://cve.radiocsirt.org/vuln/ghsa-8rgx-3gvf-26gg <p>MISP ships with PHP&#39;s phar stream wrapper registered in both its web entry point and its console entry point.</p> <p>The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:</p> <p>- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;  - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.</p> <p>No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.</p> <p>MISP ships with PHP&#39;s phar stream wrapper registered in both its web entry point and its console entry point.</p> <p>The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:</p> <p>- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;  - a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.</p> <p>No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.</p> https://cve.radiocsirt.org/vuln/ghsa-8rgx-3gvf-26gg https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3520 <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3520