CVE-2018-6926

7.2 highEPSS 1.7%

High (7.2) in misp-project misp. EPSS 1.7% chance of exploitation in the next 30 days.

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by the setting being only accessible to the site administrator.

Severity

CVSS 3.0

7.2 high

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2018-02-12
Modified: 2026-06-22
Record from: the NVD, synced 2026-10-19

Affected

misp-project:misp

References

https://github.com/MISP/MISP/commit/0a2aa9d52492d960b9a161160acedbe9caaa4126
https://github.com/MISP/MISP/commit/0a2aa9d52492d960b9a161160acedbe9caaa4126

Check your stack JSON