{"id":"CVE-2019-12868","title":"app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.","summary":"app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"misp-project","product":"misp","affected":["misp = 2.4.109"],"published":"2019-06-18","updated":"2026-06-22","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-12868","references":[{"url":"https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c","label":"cve@mitre.org"},{"url":"https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization/","label":"cve@mitre.org"},{"url":"https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.05526,"epssPercentile":0.9251,"ingestedAt":"2026-06-29T13:24:33.233Z","slug":"CVE-2019-12868","body":"## Overview\n\napp/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.\n\n## Affected\n\n- `misp = 2.4.109`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":39.6,"likelihood":1.1,"exploitation":0,"ransomware":0},"changes":[]}