The vulnerability arises from MISP registering PHP's phar stream wrapper at the entry points of its web and console interfaces. When a user supplies a filesystem path that points to a phar archive, PHP implicitly calls unserialize() on the archive contents, creating an unserialize sink. Because any code inside the phar can be executed, an attacker who can influence a path argument can upload a malicious phar and trigger arbitrary code execution as the web user. This is a classic deserialization flaw (CWE-502) combined with path handling (CWE-74).

The flaw affects the MISP platform itself. No specific product versions are listed in the advisory, so any deployed instance of MISP that has not applied the commit that removes the phar wrapper is vulnerable.

The CVSS score of 7.7 indicates high severity, but the EPSS score is not available, so the precise likelihood of exploitation is unknown. The flaw is not listed in CISA's KEV catalog. The likely attack surface is via the web interface or console commands that accept path arguments, where an attacker could upload a crafted phar file or direct a request to a phar path. Because the wrapper is unregistered by the official fix, the vulnerability is trivially removable with a simple code change or software update.