CVE-2026-72710
CriticalCVSS 9.8Summary
SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist. Attackers with a valid nonce can inject attacker-controlled rows into the spip_jobs table, and by supplying arg=job/0 with crafted fonction and args values, these are later unserialized and executed when the cron job queue is drained.
Risk Assessment
Allows an attacker to execute arbitrary PHP functions on the server, leading to full system compromise and loss of confidentiality, integrity, and availability.
Recommendation
Update SPIP to version 4.4.18 or later to eliminate the vulnerability.
Other vulnerabilities in SPIP
See all- CVE-2026-72708High
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spip_mysql_cite() in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word character followed by an open parenthesis. Attackers can supply a crafted value such as a time-based payload through the annee parameter in squelettes-dist/sitemap.xml.html to embed arbitrary SQL directly into the generated query, enabling time-based and boolean-based blind SQL injection that can expose arbitrary database content including the alea_ephemere secret used to sign action nonces.
- CVE-2026-8430High
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server.
- CVE-2026-8429High
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server.
- CVE-2026-72709Critical
SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_auteur action directly over HTTP to reset the password of any user account, including the administrator.
- CVE-2026-77806Critical
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
- CVE-2026-77647Critical
SPIP before version 4.4.20 contains a vulnerability allowing unauthenticated remote attackers to execute arbitrary code. The issue is related to incorrect identification of <?php blocks and var_export's mishandling of certain cases such as the presence of a '<' character. This vulnerability was exploited in the wild in August 2026.
- CVE-2017-9736Critical
SPIP versions 3.1.x before 3.1.6 and 3.2.x before Beta 3 do not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution.
- CVE-2016-3153Critical
SPIP versions 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allow remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
- CVE-2026-66738High
SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.
- CVE-2026-48832Low
In SPIP before version 4.4.15, the file action/cookie.php in the ecrire directory is prone to an open redirect vulnerability.
Original NVD description (English source)
SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.