CVE-2026-72710

NameCVE-2026-72710
DescriptionSPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
spip (PTS)trixie4.4.15+dfsg-0+deb13u1vulnerable
trixie (security)4.4.23+dfsg-0+deb13u1fixed
forky, sid4.4.23+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
spipsourcetrixie4.4.19+dfsg-0+deb13u1
spipsource(unstable)4.4.18+dfsg-1

Notes

https://blog.lexfo.fr/casse-spip-sqli-to-rce.html
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html

Search for package or bug name: Reporting problems