---
id: CVE-2019-12868
title: >-
  app/Model/Server.php in MISP 2.4.109 allows remote command execution by a
  super administrator because the PHP file_exists function is used with
  user-controlled entries, and phar:// URLs trigger deserialization.
summary: >-
  app/Model/Server.php in MISP 2.4.109 allows remote command execution by a
  super administrator because the PHP file_exists function is used with
  user-controlled entries, and phar:// URLs trigger deserialization.
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: misp-project
product: misp
affected:
  - misp = 2.4.109
published: '2019-06-18'
updated: '2026-06-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-12868'
references:
  - url: >-
      https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c
    label: cve@mitre.org
  - url: >-
      https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization/
    label: cve@mitre.org
  - url: >-
      https://github.com/MISP/MISP/commit/c42c5fe92783dd306b7600db1f6a25324445b40c
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://zigrin.com/advisories/misp-command-injection-via-phar-deserialization/
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.06313
epssPercentile: 0.93307
ingestedAt: '2026-06-29T13:24:33.233Z'
---

## Overview

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.

## Affected

- `misp = 2.4.109`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.