Logic Error in MISP sachertortephp Library Leading to Potential SSRF

CVE-2026-92932

What is CVE-2026-92932?

The MISP sachertortephp library contains a logic flaw within the Xml::build() static method that can lead to server-side request forgery (SSRF). Specifically, the conditional logic governing network-based XML fetching is misconfigured due to the precedence of PHP operators. This erroneous design allows an attacker to leverage the input to trigger unwanted outbound HTTPS requests to arbitrary URLs, possibly leading to sensitive information exposure from internal or external services. When the readFile option is set to false, the intended restrictions can be bypassed, creating a potential security risk that necessitates immediate attention.

References