the editer_objet action can run code

Published September 11, 2026 CVE-2026-72710

A critical SPIP flaw lets remote attackers run PHP functions on website servers. It affects releases before 4.4.18.

Severity
CriticalCVSS 3.1 · 9.8 · vulncheck.com
Fix
Fixed in 4.4.18
Affected versions
before 4.4.18
Weakness
CWE-915Mass Assignment
Affects
SPIP
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-76156ENISA vulnerability database

How it works

  • The attacker first needs a valid one-time security value.
  • They send a crafted request that inserts controlled entries into SPIP's scheduled work list.
  • Those entries specify a PHP function and its inputs.
  • SPIP reads the entries when it processes scheduled tasks.
  • It then runs the specified PHP function on the server.

What to do

If you administer a SPIP website, compare its installed version with 4.4.18. Confirm that any release before 4.4.18 is affected.

Update SPIP to 4.4.18, which the maintenance team says fixes this flaw. Verify the installed version shows 4.4.18 after updating.

Technical details

CVE-2026-72710 affects SPIP releases before 4.4.18. A request carrying a valid nonce can insert attacker-controlled entries into the spip_jobs table because editer_objet does not enforce the normal editable-field restrictions. The scheduled job system later reads the supplied fonction and args values. SPIP then executes the specified PHP function on the underlying server.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source