Deserialization Vulnerability in MISP Affected by PHAR Stream Wrapper

CVE-2026-95806

What is CVE-2026-95806?

The MISP (Malware Information Sharing Platform) has introduced a serious risk due to the improper registration of PHP's phar stream wrapper in both its web and console entry points. This vulnerability arises because the phar stream wrapper allows PHP to interpret a phar archive as a directory. As a result, filesystem operations on user-controllable paths that resolve to a phar archive can trigger unintended unserialize() calls, potentially creating a deserialization vulnerability. This facilitates an attack vector where threats can manipulate the application root to execute arbitrary code from within an uploaded phar file, compromising the web user's environment. Notably, the phar wrapper provides no beneficial function within the MISP runtime, existing only as a potential avenue for exploitation.

References