Is CVE-2026-104070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104070 being exploited in the wild.

How severe is CVE-2026-104070?

Critical severity, with a CVSS score of 9.8, published 6 October 2026.

Is there a fix for CVE-2026-104070?

Yes: fixed in Crayons 3.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104070 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104070?

Check whether you run Spip Crayons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104070: SPIP Crayons plugin missing authorization in crayons_store.php

CVE-2026-104070 · Severity: critical · CVSS 9.8 · Published 2026-10-06

The Crayons plugin for SPIP is an inline editing tool that allows quick content modification from public website pages. A missing authorization check allows unauthenticated attackers to modify any editable database fields, write malicious files, and ultimately execute arbitrary PHP code on the web server by exploiting an anti-forgery token bypass.

Vendors: Spip.

Quick answers

Is CVE-2026-104070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104070 being exploited in the wild.
How severe is CVE-2026-104070?: Critical severity, with a CVSS score of 9.8, published 6 October 2026.
Which products and versions are affected?: Spip Crayons before 3.5.0.
Is there a fix for CVE-2026-104070?: Yes: fixed in Crayons 3.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104070 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104070?: Check whether you run Spip Crayons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Crayons 3.5.0

Technical details

The vulnerability in crayons_store.php occurs when the secu_ anti-forgery parameter is omitted, causing the authorization dispatcher to resolve an unconditionally-true handler instead of performing proper modification checks. Attackers can chain this flaw to write malicious .html skeleton files, extract site secrets from configuration files, forge signed AJAX contexts, and execute arbitrary PHP code with web-server privileges via network requests without authentication.

Affected products

SPIP Crayons before 3.5.0

Timeline

2026-10-06: disclosed
2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.