Is CVE-2026-72708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72708 being exploited in the wild.

How severe is CVE-2026-72708?

High severity, with a CVSS score of 7.5, published 11 September 2026.

Is there a fix for CVE-2026-72708?

A patch was published on 2026-08-10: SPIP 4.4.18 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72708 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72708?

Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72708: SPIP unauthenticated blind SQL injection in SQL escaping

CVE-2026-72708 · Severity: high · CVSS 7.5 · Published 2026-09-11

SPIP is an open-source content management system (CMS) used to power websites for institutions, media organizations, and communities. An unauthenticated attacker can exploit a flaw in the SQL escaping layer to inject arbitrary SQL commands through a public-facing sitemap page. By extracting the database's secret nonce-signing key, attackers can forge administrative action requests and achieve remote code execution on affected servers.

Technologies: Spip. Vendors: Spip.

Quick answers

Is CVE-2026-72708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72708 being exploited in the wild.
How severe is CVE-2026-72708?: High severity, with a CVSS score of 7.5, published 11 September 2026.
Which products and versions are affected?: Spip before 4.4.18.
Is there a fix for CVE-2026-72708?: A patch was published on 2026-08-10: SPIP 4.4.18 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72708 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72708?: Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-72708 is an unauthenticated blind SQL injection vulnerability in SPIP's SQL escaping layer (sql_quote function). The vulnerability is triggered by supplying a crafted annee parameter value (matching the pattern: word character followed by an open parenthesis) to the always-present sitemap.xml.html template's annee criterion, which bypasses escaping for date-type columns. This affects MySQL, SQLite, and PostgreSQL backends. Attackers can embed time-based or boolean-based SQL payloads to extract arbitrary database content, including the alea_ephemere secret used to sign SPIP action nonces, enabling account takeover and remote code execution. The vulnerability is fixed in SPIP 4.4.18 and later, where SQL escaping for date fields has been improved to ignore only the NOW() function rather than applying overly permissive rules.

Affected products

SPIP SPIP before 4.4.18

Timeline

2026-09-11: disclosed: CVE-2026-72708 published
2026-08-10: patched: SPIP 4.4.18 released with security fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.