{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92932",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:29:40.334689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:30:42.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "lib/Cake/Utility/Xml.php"
          ],
          "product": "sachertortephp",
          "programFiles": [
            "lib/Cake/Utility/Xml.php"
          ],
          "repo": "https://github.com/MISP/sachertortephp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026amp;\u0026amp; operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).\u003c/p\u003e"
            }
          ],
          "value": "In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026\u0026 operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T12:42:02.501Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\u003c/p\u003e"
            }
          ],
          "value": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "PR:N is assumed; if the calling application requires authentication to reach Xml::build() with attacker-controlled input, the PR metric should be raised to PR:L or higher.",
                  "The affected version range is unspecified because the patch metadata does not include version tags or release boundaries.",
                  "The CAPEC-66 mapping is the closest available pattern; the exact exploitation context (which MISP endpoint or API exposes Xml::build() input) is not specified in the patch.",
                  "The HttpSocket redirect-following (up to 10 redirects) amplifies the SSRF surface but is not separately scored; it is subsumed under the SC:L impact.",
                  "The vulnerability requires the readFile option to be set to false; if all callers use the default (presumably true), the practical exploitability may be reduced, but the code still contains the logic defect."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "The closest CAPEC is SSRF: an attacker supplies a URL (https://...) as input to a server-side function, and the server fetches it over the network. The patch confirms the code path performs an HttpSocket GET with redirect-following. The uncertainty is that the exact attack vector depends on how the calling application exposes Xml::build() input; the CAPEC mapping is based on the confirmed code behavior of fetching a caller-supplied URL."
                  }
                ],
                "commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "AV:N: the vulnerable function is a library utility reachable through network-facing application code. AC:L: the attacker only needs to supply an input string starting with https://; no race or complex condition is required. AT:N: no need to bypass security controls. PR:N: assumed no authentication is required to reach the code path (assumption; if the calling application requires auth, PR should be raised). UI:N: no user interaction needed. VC/VI/VA:N: the local application\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:L: the attacker can read the HTTP response body from the fetched URL (information disclosure from the SSRF target), which is a limited impact on the target system\u0027s confidentiality. SI/SA:N: no integrity or availability impact on the target. The vector reflects a low-complexity SSRF with limited confidentiality impact on the remote target.",
                "fixSummary": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.",
                "generatedAt": "2026-09-17T12:27:24.482336Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
                "patchSummary": "In lib/Cake/Utility/Xml.php, line 110, the condition $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0 is changed to $options[\u0027readFile\u0027] \u0026\u0026 (strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0). A single pair of parentheses is added around the two strpos comparisons so that the || is evaluated before the \u0026\u0026, ensuring the readFile flag gates both URL schemes. One line changed: 1 insertion, 1 deletion.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
                    "patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
                    "source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                    "sourceUrl": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                    "subject": "fix: [security] Gate the https branch of Xml::build() on"
                  }
                ],
                "source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
                "subject": "fix: [security] Gate the https branch of Xml::build() on",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The primary security impact is that the application issues an outbound HTTPS request to an attacker-influenced URL when the caller intended to disable remote reads. The HttpSocket follows up to 10 redirects, amplifying the SSRF surface. The response is parsed and potentially returned, enabling information disclosure from internal or external targets."
                  },
                  {
                    "cweId": "CWE-670",
                    "rationale": "The root cause is a logic error: the conditional expression does not implement the intended control flow because of PHP operator precedence. The readFile gate is bypassed for the https:// branch, making the guard ineffective for that scheme. This is the underlying defect that produces the SSRF."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20250"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-92932",
    "datePublished": "2026-09-17T12:33:44.852Z",
    "dateReserved": "2026-09-17T12:33:35.124Z",
    "dateUpdated": "2026-09-17T18:30:42.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93295",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:09:12.355251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:09:27.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "app/Controller/EventsController.php",
            "app/Lib/Tools/BackgroundJobsTool.php"
          ],
          "product": "misp",
          "repo": "https://github.com/MISP/misp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "\u003c 2.5.47",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niels Teusink of Eye Security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP\u0027s ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP\u0027s ShellDispatcher::_parsePaths() scans the entire argv for path switches (-app, --app, -working, --working, -root, --root, -webroot, --webroot) and uses the following element as the application root. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker who can submit the contact form can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive. The CakePHP bootstrap then includes Config/core.php from within that archive, executing attacker-controlled PHP code with the privileges of the web user.\u00a0\n\nThe vulnerability requires the ability to submit the events/contact form (or any other endpoint that forwards user input into background job arguments). No special timing or race condition is required; the attack is deterministic once the crafted parameters are accepted. The impact is full remote code execution in the context of the MISP web server process, allowing data exfiltration, persistence, and lateral movement within the host."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-14",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-14 Parameter Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:42:13.496Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp/commit/120813344"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47, 43 commits after fix); the exact first fixed release is not explicitly stated in the patch and may differ.",
                  "PR:L assumes the events/contact endpoint requires at least a low-privilege authenticated session; if the endpoint is accessible without authentication in some MISP configurations, PR should be U (Unprivileged).",
                  "The CAPEC-14 mapping is the closest available pattern; the attack is more specifically an argument injection into a framework dispatcher rather than generic parameter manipulation, but no CAPEC entry precisely describes this mechanism.",
                  "The phar:// exploitation path assumes the target PHP process has the phar stream wrapper enabled and that the attacker can place or reference a crafted archive accessible via the phar:// URI; the patch does not explicitly confirm the phar wrapper is enabled by default.",
                  "The commit date (17 Sep 2026) is in the future relative to typical CVE timelines; this is taken at face value from the patch metadata."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-14",
                    "rationale": "The attacker manipulates the person and message parameters of the events/contact form to inject CakePHP console path switches into the background job argv. The parameters are modified so that the downstream console dispatcher interprets them as directives (setting the application root) rather than as data. This is the closest CAPEC pattern; the attack does not involve classic OS command injection (CAPEC-88) but rather argument injection into a framework-level dispatcher, making CAPEC-14 the best available match."
                  }
                ],
                "commit": "120813344f36b8fad15cd917e97b09fa3497156b",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Niels Teusink of Eye Security"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The contact endpoint is reachable over the network via HTTP. AC:L: The attack requires only crafting two form fields with a known switch string and a phar:// path; no race conditions or special timing. AT:N: No specific target configuration or state is required beyond a standard MISP installation. PR:L: The attacker needs a low-privilege authenticated MISP account with access to the event contact action. UI:N: No victim interaction is needed beyond the attacker\u0027s own form submission. VC:H, VI:H, VA:H: Successful exploitation results in arbitrary PHP code execution as the web user, giving full control over the MISP server\u0027s data, processes, and availability. SC:N, SI:N, SA:N: The impact is confined to the MISP server itself; no evidence of lateral impact on other systems.",
                "fixSummary": "The fix introduces a validation layer in BackgroundJobsTool::enqueue() that rejects any job argument matching a reserved CakePHP console path switch (-app, --app, -working, --working, -root, --root, -webroot, --webroot), throwing an InvalidArgumentException before the job is queued. Additionally, the EventsController::contact() method now casts the person field to a boolean, preventing it from ever forming a switch/value pair with the adjacent message field. Together, these changes ensure that user-supplied data can never be interpreted as a console path directive by the worker process.",
                "generatedAt": "2026-09-17T16:22:44.930762Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77",
                "patchSummary": "Three files are modified. In BackgroundJobsTool.php, a new RESERVED_ARGUMENTS constant lists the eight console path switches, and a new private validateArgs() method iterates over job arguments and throws InvalidArgumentException if any string argument exactly matches a reserved switch. The enqueue() method calls validateArgs() before dispatching. In EventsController.php, the person field assignment in contact() is changed from a raw value to (bool) cast. A new test file BackgroundJobsToolArgumentsTest.php verifies that ordinary arguments pass, free text merely containing a switch substring passes, every reserved switch is refused, and non-string arguments are unaffected.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "120813344f36b8fad15cd917e97b09fa3497156b",
                    "patchSha256": "8e176aa69e4b6c13f3909225292a96c127076f333a6a49c1824599a79533de77",
                    "source": "https://github.com/MISP/misp/commit/120813344.patch",
                    "sourceUrl": "https://github.com/MISP/misp/commit/120813344.patch",
                    "subject": "fix: [security] Refuse console path switches in background"
                  }
                ],
                "source": "https://github.com/MISP/misp/commit/120813344.patch",
                "subject": "fix: [security] Refuse console path switches in background",
                "tagVersionBoundary": {
                  "commits_after_fix": 43,
                  "repository": "https://github.com/MISP/misp",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-74",
                    "rationale": "User-controlled form fields (person, message) are passed as arguments to a downstream component (the CakePHP console dispatcher) where special elements (path switches like -app, -root) are interpreted as directives rather than data. The lack of neutralization of these special elements in the job argument vector is the root cause."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The background job enqueue path accepted arbitrary string arguments without validating them against the set of values that the downstream console dispatcher interprets as control switches. The fix adds explicit validation to reject reserved argument values."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20153"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-93295",
    "datePublished": "2026-09-17T16:25:40.730Z",
    "dateReserved": "2026-09-17T16:25:37.686Z",
    "dateUpdated": "2026-09-22T07:42:13.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:06:22.658218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:06:37.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Overmind theme - Events View (event_general.ctp)",
            "Overmind theme - Servers View (preview_general.ctp)"
          ],
          "product": "misp",
          "programFiles": [
            "app/View/Themed/Overmind/Elements/Events/View/event_general.ctp",
            "app/View/Themed/Overmind/Elements/Servers/View/preview_general.ctp"
          ],
          "repo": "https://github.com/MISP/misp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme\u0027s statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions to create or modify such objects, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim\u0027s browser, executing in the context of the MISP application origin. This could allow session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have low-level authenticated access to create or rename an object whose name is rendered in the legend, and the victim to view the Overmind event or server preview page. No special browser conditions or race conditions are required.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme\u0027s statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions to create or modify such objects, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim\u0027s browser, executing in the context of the MISP application origin. This could allow session hijacking, data exfiltration, or arbitrary actions performed on behalf of the victim.\u00a0\n\nThe vulnerability requires the attacker to have low-level authenticated access to create or rename an object whose name is rendered in the legend, and the victim to view the Overmind event or server preview page. No special browser conditions or race conditions are required."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:36:53.603Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp/commit/382188d2f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies HTML output encoding to the user-controlled label variable (lbl) before it is interpolated into the innerHTML string in both affected view templates. By wrapping the label with escapeHtml(), any HTML metacharacters in object names are neutralized, preventing injected markup from being interpreted as executable HTML or JavaScript in the viewer\u0027s browser.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies HTML output encoding to the user-controlled label variable (lbl) before it is interpolated into the innerHTML string in both affected view templates. By wrapping the label with escapeHtml(), any HTML metacharacters in object names are neutralized, preventing injected markup from being interpreted as executable HTML or JavaScript in the viewer\u0027s browser."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The exact affected version range is not explicitly stated in the patch; the tag_version_boundary indicates the fix commit is 55 commits after v2.5.47, suggesting versions up to (but not including) the release containing this commit are affected. The precise fixed version is unspecified.",
                  "PR:L assumes the attacker needs at least low-level authenticated access to create or rename a MISP object whose name appears in the Overmind legend. If unauthenticated object creation is possible in some deployment, PR could be N.",
                  "UI:P assumes the victim simply views the Overmind dashboard page (passive interaction). If the page requires a specific navigation action beyond normal browsing, UI could be A.",
                  "SC:H and SI:H assume the XSS grants full access to the victim\u0027s MISP session (cookies, API tokens, in-page data). A more conservative assessment could rate these L if the Overmind view exposes limited data.",
                  "The CAPEC-1 mapping is direct and unambiguous for this stored XSS; no uncertainty is noted beyond the standard CAPEC granularity."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attack pattern involves injecting client-side script into a web application via user-controllable data (object names) that is rendered without encoding in an HTML context. CAPEC-1 is the canonical XSS attack pattern and directly matches the mechanism: attacker-controlled data flows into an innerHTML sink. No uncertainty in this mapping; the patch explicitly describes the innerHTML concatenation of unescaped labels."
                  }
                ],
                "commit": "382188d2f27004118592cf32f970313b31abcb52",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a web browser. AC:L: Exploitation requires only creating an object with a crafted name; no race or special conditions. AT:N: The attack targets the same MISP instance. PR:L: The attacker needs low-level authenticated access to create or rename an MISP object. UI:P: The victim passively interacts by viewing the Overmind dashboard page; no click or explicit action is needed beyond normal page rendering. VC/VI/VA:N: No direct impact on the MISP server\u0027s confidentiality, integrity, or availability. SC:H/SI:H: The injected script executes in the victim\u0027s browser within the MISP origin, enabling full session compromise (cookie theft, data exfiltration, arbitrary actions). SA:N: No availability impact on the victim\u0027s browser.",
                "fixSummary": "The fix applies HTML output encoding to the user-controlled label variable (lbl) before it is interpolated into the innerHTML string in both affected view templates. By wrapping the label with escapeHtml(), any HTML metacharacters in object names are neutralized, preventing injected markup from being interpreted as executable HTML or JavaScript in the viewer\u0027s browser.",
                "generatedAt": "2026-09-17T16:28:27.480704Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "3c6f0376c712f90fde19eba1ca80cd16433ad02587b8237862fd64b60607d8bf",
                "patchSummary": "Two one-line changes in the Overmind theme view templates. In app/View/Themed/Overmind/Elements/Events/View/event_general.ctp (line 607) and app/View/Themed/Overmind/Elements/Servers/View/preview_general.ctp (line 323), the raw lbl variable used in the title attribute and inner text of the legend span element is replaced with escapeHtml(lbl). No other logic, routing, or configuration changes are made.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "382188d2f27004118592cf32f970313b31abcb52",
                    "patchSha256": "3c6f0376c712f90fde19eba1ca80cd16433ad02587b8237862fd64b60607d8bf",
                    "source": "https://github.com/MISP/misp/commit/382188d2f.patch",
                    "sourceUrl": "https://github.com/MISP/misp/commit/382188d2f.patch",
                    "subject": "fix: [security] Escape object names in the Overmind"
                  }
                ],
                "source": "https://github.com/MISP/misp/commit/382188d2f.patch",
                "subject": "fix: [security] Escape object names in the Overmind",
                "tagVersionBoundary": {
                  "commits_after_fix": 55,
                  "repository": "https://github.com/MISP/misp",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "User-controlled object names are concatenated directly into an innerHTML string without HTML encoding, allowing injected markup to execute in the victim\u0027s browser. This is a textbook stored XSS via missing output encoding at an HTML sink."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20206"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-93296",
    "datePublished": "2026-09-17T16:29:19.457Z",
    "dateReserved": "2026-09-17T16:29:16.587Z",
    "dateUpdated": "2026-09-22T07:36:53.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}