CVE-2026-72710

SPIP before 4.4.18 contains a remote code execution vulnerability in its editer_objet action, where the arg parameter is used to resolve SQL table names without enforcing an editable-columns allowlist (CWE-915). An attacker who can supply a valid nonce can submit arg=job/0 with crafted fonction and args values, causing attacker-controlled rows to be inserted into the spip_jobs table. When SPIP drains its cron job queue, those injected rows are unserialized and executed, yielding arbitrary PHP function execution on the server; the high confidentiality, integrity, and availability impacts in the CVSS 4.0 score indicate a full compromise of the affected system. Any SPIP installation running a version prior to 4.4.18 is affected. There is no public proof of concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is currently known.

What to do: Upgrade to SPIP 4.4.18 or later, which enforces the editable-columns allowlist in the editer_objet action. As an interim mitigation, restrict access to the editer_objet action and review the spip_jobs table for unexpected rows with unusual fonction or args values, and check cron logs for injected job execution. No public exploit or in-the-wild activity is known, but the critical severity warrants prompt patching.