CVE-2026-95679 - MISP Unauthenticated Blind SSRF via XML Body Processing
Brief
CVE ID : CVE-2026-95679
Published : Sept. 22, 2026, 2:17 p. m.
- 41 minutes ago
Description : MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http
- • https), where PHP operator precedence causes the https branch to bypass the readFile check entirely. As a result, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Because the cspReport endpoint accepts XML content type and is unauthenticated by design, an unauthenticated remote attacker can send a POST request with a crafted XML body to cause the MISP server to issue an outbound HTTPS request to an arbitrary target reachable from the server.