CVE-2026-95679

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

EUVD-2026-84395

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

CVE-2026-95679

CVE-2026-95679 is an unauthenticated blind SSRF in MISP , caused by a PHP operator-precedence error in the Xml::build() library's readFile guard condition (readFile && http || https), which allows the https branch to bypass the file-read check entirely. An attacker can send a crafted XML body con...