Description
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
Published: 2026-09-17
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑side request forgery
Action: Apply patch
AI Analysis

Impact

The vulnerability originates from an incorrect operator‑precedence in a conditional that controls whether external XML can be fetched. When the readFile option is set to false, the logic still allows URLs that begin with https:// to be fetched, causing the library to issue an outbound HTTPS request. The fetched content is parsed as XML and may be returned to the caller, resulting in disclosure of internal or external data. This is a classic server‑side request forgery with an information‑disclosure impact.

Affected Systems

The exposed code resides in the MISP sachertortephp library, specifically the Xml::build() static method in lib/Cake/Utility/Xml.php. Any deployment that includes sachertortephp and passes reach‑able input to Xml::build() while setting readFile to false is susceptible. The exact version range impacted is not detailed in the data, so consider all versions prior to the commit that applied the fix as vulnerable.

Risk and Exploitability

The CVSS score for this flaw is 5.1, indicating a moderate severity. No EPSS score is provided, making it difficult to assess current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack requires that an attacker can influence the $input string and that the caller disables readFile, which is feasible in many dynamic XML parsing scenarios. The compromise is limited to informational disclosure via HTTPS SSRF and does not enable arbitrary code execution, but it can still be leveraged to exfiltrate sensitive data from internal services.

Generated by OpenCVE AI on September 18, 2026 at 06:49 UTC.

Remediation

Vendor Solution

The fix corrects the operator-precedence error by adding parentheses around the scheme check so that both the http:// and https:// branches are gated by the $options['readFile'] flag. After the fix, when readFile is false, neither scheme triggers a network fetch, restoring the caller's intended control over remote reads and eliminating the SSRF vector.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch that adds parentheses to the scheme check so that the HTTPS branch is correctly gated by the readFile option
  • Verify that the Xml::build() call is not exercised with attacker‑controlled input when readFile is false; consider sanitizing or rejecting URLs prior to parsing
  • Configure HttpSocket or any outbound HTTP client to restrict redirects and to whitelist allowed destinations, reducing the potential impact if the bug were re‑introduced

Generated by OpenCVE AI on September 18, 2026 at 06:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp sachertortephp
Vendors & Products Misp
Misp sachertortephp

Thu, 17 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).
Title MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
Weaknesses CWE-670
CWE-918
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Misp Sachertortephp
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-17T18:30:42.720Z

Reserved: 2026-09-17T12:33:35.124Z

Link: CVE-2026-92932

cve-icon Vulnrichment

Updated: 2026-09-17T18:30:34.534Z

cve-icon NVD

Status : Deferred

Published: 2026-09-17T13:17:01.610

Modified: 2026-09-18T17:49:29.480

Link: CVE-2026-92932

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T20:02:25Z

Weaknesses
  • CWE-670

    Always-Incorrect Control Flow Implementation

  • CWE-918

    Server-Side Request Forgery (SSRF)