CVE-2026-56446: MISP JsonLogTool Arbitrary Path Log Injection Leading to RCE

Technical summary

CVE-2026-56446 is a code injection vulnerability in MISP's JsonLogTool component. The vulnerability stems from insufficient validation of the NDJSON error log path parameter, which allows an authenticated administrator to specify arbitrary filesystem destinations without restriction. An attacker with site administrator credentials can leverage this to: 1. Direct log output to a PHP file in a web-accessible directory (e.g., under /var/www/html or equivalent) 2. Inject PHP code through attacker-controlled log entry content 3. Access the resulting file via HTTP to trigger code execution The fix implements a whitelist-based approach: restricting log paths to pre-approved base directories (APP/tmp/logs or /var/log), requiring absolute paths, blocking stream wrappers, rejecting path traversal sequences, and limiting filenames to .log or .ndjson extensions while explicitly preventing executable extension segments such as .php.

Business impact

Organizations running MISP face significant operational risk if a site administrator is compromised or acts maliciously. Successful exploitation provides direct remote code execution on the MISP server, enabling attackers to: - Exfiltrate threat intelligence data, indicators, and internal reports - Modify or corrupt indicator data to degrade the organization's detection capabilities - Pivot to connected networks and systems (especially where MISP feeds other security tools) - Establish persistent backdoors for long-term access For security teams relying on MISP as a central intelligence platform, this translates to loss of data integrity, potential regulatory compliance failures, and operational disruption during incident response.

Affected systems

The vulnerability affects MISP (Malware Information Sharing Platform & Threat Sharing) across all installations where the JsonLogTool component is active. The fix restricts log paths to existing directories, so only instances with custom log directory configurations outside the default protected locations would remain vulnerable until patched. Verify your installed MISP version against the vendor advisory for exact patch versions containing the remediation.

Exploitability

Exploitation requires site administrator privileges, which significantly limits the attack surface. However, the vulnerability is practically exploitable if: - An attacker gains legitimate administrative access (credential theft, account compromise, insider threat) - A compromised third-party administrator account is leveraged - Social engineering convinces a site admin to enable a malicious log path configuration The attack does not require user interaction once administrative access is obtained, and no network-layer exploit is needed—a simple HTTP request to the injected PHP file triggers code execution. The CVSS 3.1 score of 7.2 (HIGH) reflects the high-impact nature of code execution despite the privileged access requirement.

Remediation

Update MISP to a version containing the fix for CVE-2026-56446. The patch implements strict validation of the JsonLogTool log path parameter by: 1. Restricting valid log destinations to directories within APP/tmp/logs or /var/log 2. Requiring absolute filesystem paths 3. Blocking stream wrappers (php://, file://, etc.) 4. Rejecting path traversal sequences (../, ..\ etc.) 5. Limiting filenames to .log or .ndjson extensions and blocking executable segments After patching, audit existing log path configurations to ensure they comply with the new restrictions. If any custom log paths were in use, migrate them to one of the approved base directories.

Patch guidance

Consult the official MISP project security advisory for specific patched versions and deployment steps. Given the HIGH severity and administrator-only attack vector, prioritize patching production instances within 2–4 weeks depending on your risk profile and the sensitivity of data in your MISP instance. Test patches in a non-production environment first to ensure compatibility with your logging pipeline and any downstream tools consuming MISP logs. For air-gapped or offline MISP instances, the risk is lower but not eliminated if administrator accounts could be compromised through external means (e.g., credential leaks).

Detection guidance

Detection is most effective at configuration and log levels: 1. **Configuration audit**: Periodically review MISP admin settings to confirm log paths point only to approved directories (APP/tmp/logs or /var/log) and use .log or .ndjson extensions. 2. **File integrity monitoring**: Monitor web-accessible directories (e.g., /var/www/html) for unexpected .php or executable files created around the same time as suspicious MISP logs. 3. **Log analysis**: Search MISP logs for attempts to set log paths containing "../", stream wrappers ("php://", "file://"), or non-.log/.ndjson extensions—these would be blocked by the fix but may appear in unpatched instances. 4. **Web access logs**: Look for HTTP requests to unusual .php files in web-accessible areas that correlate with MISP admin activity or log timestamps. Note: This vulnerability requires administrative action to create the malicious log path, so detection depends on finding either the misconfiguration or the resulting injected files.

Why prioritize this

Although CVE-2026-56446 requires site administrator privileges to exploit, the impact is severe: unauthenticated remote code execution on the MISP server itself. MISP often serves as a central intelligence hub for security teams, making a compromise particularly damaging. Organizations should prioritize patching based on: - **Tier 1**: MISP instances handling sensitive or classified threat intelligence, those directly connected to production security tools, or instances accessible by non-trusted administrators. - **Tier 2**: Internal MISP instances in lower-risk environments or with strong access controls. - **Tier 3**: Isolated lab or test instances. The fact that it is not yet on the CISA Known Exploited Vulnerabilities list does not reduce urgency—the fix has been available and the attack path is straightforward.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects a high-impact vulnerability with a significant but restricted attack surface: - **Attack Vector (N)**: Network—the injected PHP file is accessed via HTTP. - **Attack Complexity (L)**: Low—once the malicious log path is set, code execution is automatic on file access. - **Privileges Required (H)**: High—only site administrators can configure the log path. - **User Interaction (N)**: None required after the configuration is changed. - **Scope (U)**: Unchanged—impact is confined to the MISP server. - **Confidentiality, Integrity, Availability (H/H/H)**: Complete compromise of the server is possible (code execution). The score appropriately weighs the privileged requirement against the severity of unauthenticated RCE, making this a clear priority for administrative security controls and timely patching.

Frequently asked questions