Quick answers
- Is CVE-2026-72710 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72710 being exploited in the wild.
- How severe is CVE-2026-72710?
- Critical severity, with a CVSS score of 9.8, published 11 September 2026.
- Which products and versions are affected?
- Spip before 4.4.18.
- Is there a fix for CVE-2026-72710?
- A patch was published on 2026-08-10: Fixed in SPIP 4.4.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-72710 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-72710?
- Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a mass assignment flaw in the editer_objet action that allows unauthenticated attackers to insert or modify arbitrary rows in any SQL table that lacks a champs_editables allowlist. By supplying an attacker-controlled arg parameter, an attacker can write to internal database tables including spip_jobs. The attacker can craft a malicious job row specifying a PHP function and arguments, which is then dynamically executed when the system's cron processor handles the queue. This chain—unauthenticated SQL injection to leak the session secret (alea_ephemere), followed by mass assignment—results in pre-authentication remote code execution. The vulnerability affects SPIP before version 4.4.18, which introduced stricter authorization checks and validation requiring champs_editables to be defined for editable objects.
Affected products
- SPIP SPIP before 4.4.18
Timeline
- 2026-09-16: disclosed: Vulnerability details published by Lexfo security blog
- 2026-08-10: patched: Fixed in SPIP 4.4.18
- 2026-09-11: advisory: CVE-2026-72710 published