Arbitrary Log Path Configuration Enables PHP Code Injection

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a web-accessible directory and inject PHP code through logged data. Accessing the resulting file could lead to remote code execution with the privileges of the web server process. The fix restricts log destinations to existing directories beneath APP/tmp/logs or /var/log, requires absolute paths, rejects stream wrappers and traversal-related input, and limits filenames to .log or .ndjson extensions while disallowing executable extension segments.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

MISP's JsonLogTool vulnerability stems from insufficient validation of administrator-configured filesystem paths for error logs. Site administrators can specify arbitrary locations for NDJSON log output, and because these logs capture attacker-controlled data, a malicious administrator or compromised admin account can direct logs to a web-accessible PHP file. By crafting requests that inject PHP code into logged fields, attackers transform the log file into executable code, achieving remote code execution (RCE) with web server privileges. This vulnerability is particularly dangerous because it requires only administrative access—a threat model that encompasses insider threats, credential compromise, and multi-stage attacks where initial access leads to privilege escalation.

Casky's 322 matching skills help practitioners detect this attack pattern by mapping to MITRE ATT&CK's Resource Development (TA0001) and Resource Access (TA0043) techniques, along with the underlying CWE-94 (Improper Control of Generation of Code—Code Injection). Practitioners using Casky would identify suspicious activity chains: administrators modifying log configuration paths to web directories, followed by unusual error log entries containing PHP syntax, and subsequent HTTP requests to those log file locations. Claude's extended reasoning capability correlates these behavioral indicators across multiple data sources—configuration audit logs, web access logs, and application activity—surfacing the complete attack narrative. Defenders would see findings flagging path traversal patterns in configuration changes combined with code injection signatures in logged content, enabling early detection before log files are accessed and executed.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-56446.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-56446

Casky has 322 skills that investigate the attack patterns behind CVE-2026-56446. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn