Executive brief
SPIP is an open-source content management system (CMS) used to power websites for institutions, media organizations, and communities. An unauthenticated attacker can exploit a flaw in the SQL escaping layer to inject arbitrary SQL commands through a public-facing sitemap page. By extracting the database's secret nonce-signing key, attackers can forge administrative action requests and achieve remote code execution on affected servers.
Technical details
CVE-2026-72708 is an unauthenticated blind SQL injection vulnerability in SPIP's SQL escaping layer (sql_quote function). The vulnerability is triggered by supplying a crafted annee parameter value (matching the pattern: word character followed by an open parenthesis) to the always-present sitemap.xml.html template's annee criterion, which bypasses escaping for date-type columns. This affects MySQL, SQLite, and PostgreSQL backends. Attackers can embed time-based or boolean-based SQL payloads to extract arbitrary database content, including the alea_ephemere secret used to sign SPIP action nonces, enabling account takeover and remote code execution. The vulnerability is fixed in SPIP 4.4.18 and later, where SQL escaping for date fields has been improved to ignore only the NOW() function rather than applying overly permissive rules.
Affected products
- SPIP SPIP before 4.4.18
Timeline
- 2026-09-11: disclosed: CVE-2026-72708 published
- 2026-08-10: patched: SPIP 4.4.18 released with security fixes