Executive brief
SPIP is a widely-used French open-source CMS powering institutional, media, and community websites. An unauthenticated attacker can exploit a mass assignment vulnerability in the editer_objet action to write arbitrary data to any SQL table, then insert a malicious job into the system's queue that gets executed during cron processing, achieving remote code execution on servers running affected versions.
Technical details
The vulnerability is a mass assignment flaw in the editer_objet action that allows unauthenticated attackers to insert or modify arbitrary rows in any SQL table that lacks a champs_editables allowlist. By supplying an attacker-controlled arg parameter, an attacker can write to internal database tables including spip_jobs. The attacker can craft a malicious job row specifying a PHP function and arguments, which is then dynamically executed when the system's cron processor handles the queue. This chain—unauthenticated SQL injection to leak the session secret (alea_ephemere), followed by mass assignment—results in pre-authentication remote code execution. The vulnerability affects SPIP before version 4.4.18, which introduced stricter authorization checks and validation requiring champs_editables to be defined for editable objects.
Affected products
- SPIP SPIP before 4.4.18
Timeline
- 2026-09-16: disclosed: Vulnerability details published by Lexfo security blog
- 2026-08-10: patched: Fixed in SPIP 4.4.18
- 2026-09-11: advisory: CVE-2026-72710 published