CVE-2026-72710
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs_editables allowlist. Attackers can insert a malicious row into the spip_jobs queue with a controlled PHP function and arguments, which is then dynamically executed when the cron processes the queue, resulting in remote code execution.
Risk Assessment
The vulnerability allows an unauthenticated attacker to achieve remote code execution on the server, potentially leading to full system compromise and data exfiltration. The risk is critical for organizations using SPIP versions below 4.4.18.
Recommendation
Update SPIP to version 4.4.18 or later. If updating is not possible, restrict access to the editer_objet action and secure the spip_jobs queue against unauthorized writes.
Other vulnerabilities in SPIP
See all- CVE-2026-8430High
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server.
- CVE-2026-8429High
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server.
- CVE-2026-72709Critical
SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level authorization guards through direct HTTP requests to invoke actions such as editer_auteur, enabling arbitrary account password rewrites including administrator accounts and resulting in full account takeover.
- CVE-2026-77806Critical
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
- CVE-2026-77647Critical
SPIP before version 4.4.20 contains a vulnerability allowing unauthenticated remote attackers to execute arbitrary code. The issue is related to incorrect identification of <?php blocks and var_export's mishandling of certain cases such as the presence of a '<' character. This vulnerability was exploited in the wild in August 2026.
- CVE-2017-9736Critical
SPIP versions 3.1.x before 3.1.6 and 3.2.x before Beta 3 do not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution.
- CVE-2016-3153Critical
SPIP versions 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allow remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- CVE-2026-109378Medium
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.
- CVE-2026-72708High
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.
- CVE-2026-66738High
SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.
Original NVD description (English source)
SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs_editables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attackers can insert a malicious row into the spip_jobs queue with a controlled PHP function and arguments, which is then dynamically executed when the cron processes the queue, resulting in remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS