CVE-2026-93295

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description A flaw in the background job dispatch mechanism allows remote code execution with the privileges of the web user. The issue occurs because background job arguments are passed directly as the argv of the CakePHP console process. The ShellDispatcher:: parsePaths() function scans argv for path switches such as -app, --app, -working, --working, -root, --root, -webroot, and --webroot, using the subsequent element as the application root. Specifically, the 'events/contact' endpoint forwards the message and person fields into job arguments without validation. An attacker can set the person field to a reserved switch and the message field to a phar:// URI (a PHP archive wrapper) pointing to a malicious archive. This causes the CakePHP bootstrap to include Config/core.php from the archive, executing arbitrary PHP code. This allows for data exfiltration, persistence, and lateral movement within the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.