CVE-2026-72710 PUBLISHED

SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection

Assigner: VulnCheck
Reserved: 10.08.2026 Published: 11.09.2026 Updated: 11.09.2026

SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor SPIP
Product SPIP
Versions Default: unaffected
  • affected from 0 to 4.4.18 (excl.)

Credits

  • Franck Chevalier finder
  • Wayko finder

References

Problem Types

  • Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE