CVE-2026-72708

SPIP before 4.4.18 is vulnerable to an unauthenticated blind SQL injection in its public sitemap endpoint, caused by a flaw in the MySQL escaper spip_mysql_cite() in ecrire/req/mysql.php that returns values unescaped when the target column is a date type and the supplied value matches a word character followed by an open parenthesis. An attacker sends a crafted value, such as a time-based payload, via the annee parameter of squelettes-dist/sitemap.xml.html, causing arbitrary SQL to be embedded directly into the generated query. Because the injection is blind, the attacker relies on time-based or boolean-based responses to extract arbitrary database content, including the alea_ephemere secret used to sign action nonces, which could enable further attacks against authenticated actions. Any SPIP site running a version prior to 4.4.18 with the public sitemap reachable is affected, and no authentication is required to exploit the flaw. There is currently no known public proof-of-concept, the issue is not listed in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Upgrade SPIP to version 4.4.18 or later, which fixes the spip_mysql_cite() escaping flaw. If upgrading is not immediately possible, restrict or disable public access to the sitemap endpoint (squelettes-dist/sitemap.xml.html) or filter/validate the annee parameter at a reverse proxy or WAF. After remediation, check logs for anomalous delays or unusual annee parameter values in sitemap requests, and consider rotating the alea_ephemere secret if compromise is suspected.