CVE-2026-95679

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

EUVD-2026-84395

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

CVE-2026-95679 MISP Unauthenticated Blind SSRF via XML Body Processing

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

CVE-2026-95679 MISP Unauthenticated Blind SSRF via XML Body Processing

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

PT-2026-96735

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The RequestHandlerComponent automatically decodes XML request bodies on all write requests. A logic error exists in the Xml::build library within its readFile guard condition due to PHP operator...

CVE-2026-95679: Server-Side Request Forgery (SSRF)

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

Denial Of Service (DoS)

cakephp/cakephp is vulnerable to Denial Of Service. The vulnerability exists due to the RequestHandlerComponent that leverages Xml::build, which allows an attacker to cause an application crash by reading local files...

CakePHP vulnerable to Denial of Service attack through XML payloads

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages Xml::build which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML...

GHSA-Q79M-C546-2G63 CakePHP vulnerable to Denial of Service attack through XML payloads

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages Xml::build which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML...

Potential for Information Disclosure in Application Skeleton

Potential for Information Disclosure in Application Skeleton The default application skeleton contained a beforeRender method on the AppController that could potentially lead to unwanted information disclosure in your application. The unsafe default code was present between 3.1.0 and 3.5.0 of the...

CakePHP 2.6.6 and 3.0.6 Released

CakePHP 2.6.6 and 3.0.6 Released The CakePHP core team is ready to announce the immediate availability of CakePHP 2.6.6 and 3.0.6. These are maintenance releases that contain important security fixes. Security Fixes Earlier this week we were notified that RequestHandlerComponent had a vulnerabili...