# CVE-2026-72710: SPIP mass assignment in editer_objet leading to RCE

Source: https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-72710 · Severity: critical · CVSS 9.8 · Published 2026-09-11

SPIP is a widely-used French open-source CMS powering institutional, media, and community websites. An unauthenticated attacker can exploit a mass assignment vulnerability in the editer_objet action to write arbitrary data to any SQL table, then insert a malicious job into the system's queue that gets executed during cron processing, achieving remote code execution on servers running affected versions.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2026-72710 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72710 being exploited in the wild.

**How severe is CVE-2026-72710?** Critical severity, with a CVSS score of 9.8, published 11 September 2026.

**Which products and versions are affected?** Spip before 4.4.18.

**Is there a fix for CVE-2026-72710?** A patch was published on 2026-08-10: Fixed in SPIP 4.4.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72710 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-72710?** Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a mass assignment flaw in the editer_objet action that allows unauthenticated attackers to insert or modify arbitrary rows in any SQL table that lacks a champs_editables allowlist. By supplying an attacker-controlled arg parameter, an attacker can write to internal database tables including spip_jobs. The attacker can craft a malicious job row specifying a PHP function and arguments, which is then dynamically executed when the system's cron processor handles the queue. This chain—unauthenticated SQL injection to leak the session secret (alea_ephemere), followed by mass assignment—results in pre-authentication remote code execution. The vulnerability affects SPIP before version 4.4.18, which introduced stricter authorization checks and validation requiring champs_editables to be defined for editable objects.

## Affected products

- SPIP SPIP before 4.4.18

## Timeline

- 2026-09-16: disclosed: Vulnerability details published by Lexfo security blog
- 2026-08-10: patched: Fixed in SPIP 4.4.18
- 2026-09-11: advisory: CVE-2026-72710 published

## References

- [https://blog.lexfo.fr/casse-spip-sqli-to-rce.html](https://blog.lexfo.fr/casse-spip-sqli-to-rce.html)
- [https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html](https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)
- [SPIP code injection in X-Spip-Filtre header](https://junglewise.ai/threats/cve-2026-77806-spip-code-injection-in-x-spip-filtre-header)