CVE-2026-95806

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description MISP registers the PHP phar stream wrapper in its web and console entry points. This wrapper causes PHP to treat phar archives as directories, leading to two security risks: any filesystem operation on a path influenced by a caller that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink, and a relocated application root may access executable code within an uploaded phar file, allowing arbitrary code execution as the web user. The wrapper serves no legitimate purpose within the MISP runtime, the CakePHP framework, or its loaded libraries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.