CVE-2026-92932 (GCVE-0-2026-92932)
Vulnerability from cvelistv5
Published
2026-09-17 12:33
Modified
2026-09-17 18:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| misp | sachertortephp |
Version: 0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:29:40.334689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:30:42.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"lib/Cake/Utility/Xml.php"
],
"product": "sachertortephp",
"programFiles": [
"lib/Cake/Utility/Xml.php"
],
"repo": "https://github.com/MISP/sachertortephp",
"vendor": "misp",
"versions": [
{
"lessThan": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "finder",
"value": "iglocska"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026amp;\u0026amp; operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).\u003c/p\u003e"
}
],
"value": "In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026\u0026 operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false)."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-670",
"description": "CWE-670 Always-Incorrect Control Flow Implementation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:42:02.501Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\u003c/p\u003e"
}
],
"value": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"PR:N is assumed; if the calling application requires authentication to reach Xml::build() with attacker-controlled input, the PR metric should be raised to PR:L or higher.",
"The affected version range is unspecified because the patch metadata does not include version tags or release boundaries.",
"The CAPEC-66 mapping is the closest available pattern; the exact exploitation context (which MISP endpoint or API exposes Xml::build() input) is not specified in the patch.",
"The HttpSocket redirect-following (up to 10 redirects) amplifies the SSRF surface but is not separately scored; it is subsumed under the SC:L impact.",
"The vulnerability requires the readFile option to be set to false; if all callers use the default (presumably true), the practical exploitability may be reduced, but the code still contains the logic defect."
],
"capecRationale": [
{
"capecId": "CAPEC-66",
"rationale": "The closest CAPEC is SSRF: an attacker supplies a URL (https://...) as input to a server-side function, and the server fetches it over the network. The patch confirms the code path performs an HttpSocket GET with redirect-following. The uncertainty is that the exact attack vector depends on how the calling application exposes Xml::build() input; the CAPEC mapping is based on the confirmed code behavior of fetching a caller-supplied URL."
}
],
"commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
}
],
"cvssRationale": "AV:N: the vulnerable function is a library utility reachable through network-facing application code. AC:L: the attacker only needs to supply an input string starting with https://; no race or complex condition is required. AT:N: no need to bypass security controls. PR:N: assumed no authentication is required to reach the code path (assumption; if the calling application requires auth, PR should be raised). UI:N: no user interaction needed. VC/VI/VA:N: the local application\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:L: the attacker can read the HTTP response body from the fetched URL (information disclosure from the SSRF target), which is a limited impact on the target system\u0027s confidentiality. SI/SA:N: no integrity or availability impact on the target. The vector reflects a low-complexity SSRF with limited confidentiality impact on the remote target.",
"fixSummary": "The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.",
"generatedAt": "2026-09-17T12:27:24.482336Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
"patchSummary": "In lib/Cake/Utility/Xml.php, line 110, the condition $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0 is changed to $options[\u0027readFile\u0027] \u0026\u0026 (strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0). A single pair of parentheses is added around the two strpos comparisons so that the || is evaluated before the \u0026\u0026, ensuring the readFile flag gates both URL schemes. One line changed: 1 insertion, 1 deletion.",
"patchTruncated": false,
"patches": [
{
"commit": "1c2da20cbe3f1e2a91458fe9a017823b7273fdac",
"patchSha256": "a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6",
"source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
"sourceUrl": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
"subject": "fix: [security] Gate the https branch of Xml::build() on"
}
],
"source": "https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch",
"subject": "fix: [security] Gate the https branch of Xml::build() on",
"weaknessRationale": [
{
"cweId": "CWE-918",
"rationale": "The primary security impact is that the application issues an outbound HTTPS request to an attacker-influenced URL when the caller intended to disable remote reads. The HttpSocket follows up to 10 redirects, amplifying the SSRF surface. The response is parsed and potentially returned, enabling information disclosure from internal or external targets."
},
{
"cweId": "CWE-670",
"rationale": "The root cause is a logic error: the conditional expression does not implement the intended control flow because of PHP operator precedence. The readFile gate is bypassed for the https:// branch, making the guard ineffective for that scheme. This is the underlying defect that produces the SSRF."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20250"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-92932",
"datePublished": "2026-09-17T12:33:44.852Z",
"dateReserved": "2026-09-17T12:33:35.124Z",
"dateUpdated": "2026-09-17T18:30:42.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-92932\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-17T18:29:40.334689Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-17T18:30:34.534Z\"}}], \"cna\": {\"title\": \"MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"x_gcve\": [{\"vulnId\": \"gcve-1-2026-20250\", \"extensions\": {\"bcp-05-x-01\": {\"ai_annotations\": [{\"tags\": [\"ai-computer-assisted:llm-generated\", \"ai-computer-assisted:classification\"], \"scope\": \"record\", \"models\": [{\"name\": \"qwen3.8:27b\", \"source\": \"ollama\", \"gna_source\": 1, \"identifier\": \"qwen3.8:27b\"}], \"ai_level\": \"generated\", \"gna_source\": 1, \"description\": \"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.\", \"review_status\": \"full\"}]}, \"bcp-05-x-02\": {\"x_patch2vuln\": {\"model\": \"qwen3.8:27b\", \"commit\": \"1c2da20cbe3f1e2a91458fe9a017823b7273fdac\", \"source\": \"https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch\", \"credits\": [{\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}], \"patches\": [{\"commit\": \"1c2da20cbe3f1e2a91458fe9a017823b7273fdac\", \"source\": \"https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch\", \"subject\": \"fix: [security] Gate the https branch of Xml::build() on\", \"sourceUrl\": \"https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac.patch\", \"patchSha256\": \"a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6\"}], \"subject\": \"fix: [security] Gate the https branch of Xml::build() on\", \"generator\": \"patch2vuln.py\", \"confidence\": \"medium\", \"fixSummary\": \"The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\", \"assumptions\": [\"PR:N is assumed; if the calling application requires authentication to reach Xml::build() with attacker-controlled input, the PR metric should be raised to PR:L or higher.\", \"The affected version range is unspecified because the patch metadata does not include version tags or release boundaries.\", \"The CAPEC-66 mapping is the closest available pattern; the exact exploitation context (which MISP endpoint or API exposes Xml::build() input) is not specified in the patch.\", \"The HttpSocket redirect-following (up to 10 redirects) amplifies the SSRF surface but is not separately scored; it is subsumed under the SC:L impact.\", \"The vulnerability requires the readFile option to be set to false; if all callers use the default (presumably true), the practical exploitability may be reduced, but the code still contains the logic defect.\"], \"generatedAt\": \"2026-09-17T12:27:24.482336Z\", \"patchSha256\": \"a5f13eb5fbceae218145d722667feb055f471f151ea64de8acd0257358816af6\", \"patchSummary\": \"In lib/Cake/Utility/Xml.php, line 110, the condition $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0 is changed to $options[\u0027readFile\u0027] \u0026\u0026 (strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0). A single pair of parentheses is added around the two strpos comparisons so that the || is evaluated before the \u0026\u0026, ensuring the readFile flag gates both URL schemes. One line changed: 1 insertion, 1 deletion.\", \"cvssRationale\": \"AV:N: the vulnerable function is a library utility reachable through network-facing application code. AC:L: the attacker only needs to supply an input string starting with https://; no race or complex condition is required. AT:N: no need to bypass security controls. PR:N: assumed no authentication is required to reach the code path (assumption; if the calling application requires auth, PR should be raised). UI:N: no user interaction needed. VC/VI/VA:N: the local application\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:L: the attacker can read the HTTP response body from the fetched URL (information disclosure from the SSRF target), which is a limited impact on the target system\u0027s confidentiality. SI/SA:N: no integrity or availability impact on the target. The vector reflects a low-complexity SSRF with limited confidentiality impact on the remote target.\", \"capecRationale\": [{\"capecId\": \"CAPEC-66\", \"rationale\": \"The closest CAPEC is SSRF: an attacker supplies a URL (https://...) as input to a server-side function, and the server fetches it over the network. The patch confirms the code path performs an HttpSocket GET with redirect-following. The uncertainty is that the exact attack vector depends on how the calling application exposes Xml::build() input; the CAPEC mapping is based on the confirmed code behavior of fetching a caller-supplied URL.\"}], \"patchTruncated\": false, \"modelComparison\": {\"rankings\": [{\"model\": \"qwen3.8:27b\", \"score\": 5, \"confidence\": \"medium\", \"agreementScore\": 9, \"assumptionCount\": 5}], \"selectedModel\": \"qwen3.8:27b\", \"selectionMethod\": \"deterministic-consensus-v1\", \"selectionNotice\": \"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.\"}, \"weaknessRationale\": [{\"cweId\": \"CWE-918\", \"rationale\": \"The primary security impact is that the application issues an outbound HTTPS request to an attacker-influenced URL when the caller intended to disable remote reads. The HttpSocket follows up to 10 redirects, amplifying the SSRF surface. The response is parsed and potentially returned, enabling information disclosure from internal or external targets.\"}, {\"cweId\": \"CWE-670\", \"rationale\": \"The root cause is a logic error: the conditional expression does not implement the intended control flow because of PHP operator precedence. The readFile gate is bypassed for the https:// branch, making the guard ineffective for that scheme. This is the underlying defect that produces the SSRF.\"}]}}}, \"recordType\": \"advisory\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"iglocska\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"iglocska\"}], \"impacts\": [{\"capecId\": \"CAPEC-66\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-66 Server Side Request Forgery\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/MISP/sachertortephp\", \"vendor\": \"misp\", \"modules\": [\"lib/Cake/Utility/Xml.php\"], \"product\": \"sachertortephp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1c2da20cbe3f1e2a91458fe9a017823b7273fdac\", \"versionType\": \"semver\"}], \"programFiles\": [\"lib/Cake/Utility/Xml.php\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options[\u0027readFile\u0027] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller\u0027s intended control over remote reads and eliminating the SSRF vector.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac\", \"name\": \"Security patch\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026\u0026 operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026\u0026 strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0 || strpos($input, \u0027https://\u0027) === 0. Because PHP\u0027s \u0026amp;\u0026amp; operator has higher precedence than ||, the expression is evaluated as ($options[\u0027readFile\u0027] \u0026amp;\u0026amp; strpos($input, \u0027http://\u0027) === 0) || strpos($input, \u0027https://\u0027) === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-670\", \"description\": \"CWE-670 Always-Incorrect Control Flow Implementation\"}]}], \"providerMetadata\": {\"orgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"shortName\": \"CIRCL\", \"dateUpdated\": \"2026-09-17T12:42:02.501Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-92932\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-17T18:30:42.720Z\", \"dateReserved\": \"2026-09-17T12:33:35.124Z\", \"assignerOrgId\": \"5a6e4751-2f3f-4070-9419-94fb35b644e8\", \"datePublished\": \"2026-09-17T12:33:44.852Z\", \"assignerShortName\": \"CIRCL\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…