PT-2026-51310

CVE-2026-56446

Published

2026-06-22

Updated

2026-06-23

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A site administrator can configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Since log entries can contain attacker-controlled content, an authenticated attacker with site administrator privileges can direct log output to a PHP file within a web-accessible directory and inject PHP code. Accessing this file allows for remote code execution with the privileges of the web server process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Andras Iklody

Jakub Chyliński

Jeroen Pinoy

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')