CVE-2026-66738

Name	CVE-2026-66738
Description	SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6435-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
spip (PTS)	bullseye	3.2.11-3+deb11u10	vulnerable
	bullseye (security)	3.2.11-3+deb11u7	vulnerable
	trixie	4.4.15+dfsg-0+deb13u1	vulnerable
	trixie (security)	4.4.19+dfsg-0+deb13u1	fixed
	forky	4.4.16+dfsg-1	vulnerable
	sid	4.4.19+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
spip	source	trixie	4.4.19+dfsg-0+deb13u1		DSA-6435-1
spip	source	(unstable)	4.4.18+dfsg-1

https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html