MISP allowed site administrators to set an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because the log entries can contain attacker‑controlled data, an authenticated administrator could configure the log destination to point to a PHP file inside a web‑accessible directory and inject PHP code through the logged content. When the generated file is accessed via a web browser, the PHP code is executed with the privileges of the web server process, resulting in remote code execution.

The vulnerability affects the MISP platform and its various deployments. No specific affected versions are listed in the advisory, so any installation that has not applied the patch restricting log destinations to APP/tmp/logs or /var/log with only .log or .ndjson filenames is potentially vulnerable.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector requires an attacker to possess site‑administrator authentication; once that privilege is available, the exploitation is straightforward because the path can be manipulated to create an executable PHP file. The fix requires changing the log configuration to accept only legitimate directories and file names, preventing the injection of executable code.