Remote Code Execution Vulnerability in MISP Logging Configuration

CVE-2026-56446

What is CVE-2026-56446?

A security vulnerability in MISP's log configuration allows an authenticated site administrator to set an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. By exploiting this flaw, an attacker can direct log output to a PHP file located in a publicly accessible directory. This can result in the injection of PHP code through crafted log entries. If successfully executed, this could lead to remote code execution with the privileges of the web server process. The recent patch addresses this issue by enforcing strict limitations on log destinations, ensuring they are confined to specified directories, rejecting unsafe input patterns, and allowing only specific file extensions.

References