CVE-2019-12868: Misp-Project Misp

High severity, CVSS 7.2. EPSS: 6.2% chance of exploitation in the next 30 days.

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.

Affected products

• Misp-Project Misp: version 2.4.109 only

Published 2019-06-18. Last modified 2026-06-22.