---
id: CVE-2026-92932
title: >-
  In the MISP sachertortephp library, the Xml::build() static method in
  lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates
  network-based XML fetching
summary: >-
  In the MISP sachertortephp library, the Xml::build() static method in
  lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates
  network-based XML fetching. The original condition was written as:
  $options['readFile'] &…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-670
  - CWE-918
vendor: misp
product: sachertortephp
affected:
  - sachertortephp < 1c2da20cbe3f1e2a91458fe9a017823b7273fdac
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T17:49:29.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92932'
references:
  - url: >-
      https://github.com/MISP/sachertortephp/commit/1c2da20cbe3f1e2a91458fe9a017823b7273fdac
    label: 5a6e4751-2f3f-4070-9419-94fb35b644e8
tags:
  - nvd
  - cve.org
epss: 0.0023
epssPercentile: 0.14068
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T18:29:40.334689Z'
cvssSource: cna
ingestedAt: '2026-09-17T13:18:16.981Z'
---

## Overview

In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.