CVE-2026-66738
HighCVSS 8.8Summary
SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.
Risk Assessment
An attacker can execute arbitrary commands on the web server, potentially leading to full system compromise or data theft.
Recommendation
Update SPIP to version 4.4.18 or later, which includes the fix.
Original NVD description (English source)
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.