# Spip vulnerabilities Source: https://junglewise.ai/threats/vendors/spip Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/spip.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Spip: 0 in the last 7 days and 8 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-122032, was published on 4 November 2026. 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 8 - All time: 17 (5 critical, 0 exploited in the wild) ## About Spip SPIP is a free and open-source content management system for website publishing. ## Latest Spip vulnerabilities - [CVE-2026-122032: SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that) (medium, CVSS 6.5, published 4 Nov 2026) - [CVE-2026-109378: SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-104070: SPIP Crayons plugin missing authorization in crayons_store.php](https://junglewise.ai/threats/cve-2026-104070-the-crayons-plugin-for-spip-before-3-5-0-contains-a-missing) (critical, CVSS 9.8, published 6 Oct 2026) - [CVE-2026-72710: SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce) (critical, CVSS 9.8, published 11 Sep 2026) - [CVE-2026-72709: SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions) (critical, CVSS 9.8, published 11 Sep 2026) - [CVE-2026-72708: SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping) (high, CVSS 7.5, published 11 Sep 2026) - [CVE-2026-77806: SPIP code injection in X-Spip-Filtre header](https://junglewise.ai/threats/cve-2026-77806-spip-code-injection-in-x-spip-filtre-header) (critical, CVSS 9.8, published 21 Aug 2026) - [CVE-2026-77647: SPIP remote code execution via PHP block parsing](https://junglewise.ai/threats/cve-2026-77647-spip-remote-code-execution-via-php-block-parsing) (critical, CVSS 9.8, published 20 Aug 2026) - [CVE-2026-66738: SPIP code injection in navigation endpoint](https://junglewise.ai/threats/cve-2026-66738-spip-code-injection-in-navigation-endpoint) (high, CVSS 8.8, published 10 Aug 2026) - [CVE-2026-48832: SPIP open redirect in action/cookie.php](https://junglewise.ai/threats/cve-2026-48832-spip-open-redirect-in-action-cookie-php) (low, CVSS 3.5, published 24 May 2026) - [CVE-2026-8430: SPIP remote code execution in public space via Nginx](https://junglewise.ai/threats/cve-2026-8430-spip-remote-code-execution-in-public-space-via-nginx) (high, CVSS 8.1, published 12 May 2026) - [CVE-2026-8429: SPIP remote code execution in private space](https://junglewise.ai/threats/cve-2026-8429-spip-remote-code-execution-in-private-space) (high, CVSS 8.8, published 12 May 2026) - [CVE-2016-7999: SPIP SSRF in valider_xml.php](https://junglewise.ai/threats/cve-2016-7999-spip-ssrf-in-valider-xml-php) (high, CVSS 7.4, published 18 Jan 2017) - [CVE-2016-7998: SPIP remote PHP code execution in template compiler](https://junglewise.ai/threats/cve-2016-7998-spip-remote-php-code-execution-in-template-compiler) (high, CVSS 8.8, published 18 Jan 2017) - [CVE-2016-7982: SPIP directory traversal in valider_xml.php](https://junglewise.ai/threats/cve-2016-7982-spip-directory-traversal-in-valider-xml-php) (high, CVSS 7.5, published 18 Jan 2017) - [CVE-2016-7981: SPIP reflected XSS in valider_xml.php](https://junglewise.ai/threats/cve-2016-7981-spip-reflected-xss-in-valider-xml-php) (medium, CVSS 6.1, published 18 Jan 2017) - [CVE-2016-7980: SPIP CSRF in XML validator](https://junglewise.ai/threats/cve-2016-7980-spip-csrf-in-xml-validator) (high, CVSS 8.8, published 18 Jan 2017) ## Most severe Spip vulnerabilities - [CVE-2026-77806: SPIP code injection in X-Spip-Filtre header](https://junglewise.ai/threats/cve-2026-77806-spip-code-injection-in-x-spip-filtre-header) (critical, CVSS 9.8, published 21 Aug 2026) - [CVE-2026-77647: SPIP remote code execution via PHP block parsing](https://junglewise.ai/threats/cve-2026-77647-spip-remote-code-execution-via-php-block-parsing) (critical, CVSS 9.8, published 20 Aug 2026) - [CVE-2026-72710: SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce) (critical, CVSS 9.8, published 11 Sep 2026) - [CVE-2026-72709: SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions) (critical, CVSS 9.8, published 11 Sep 2026) - [CVE-2026-104070: SPIP Crayons plugin missing authorization in crayons_store.php](https://junglewise.ai/threats/cve-2026-104070-the-crayons-plugin-for-spip-before-3-5-0-contains-a-missing) (critical, CVSS 9.8, published 6 Oct 2026) - [CVE-2026-66738: SPIP code injection in navigation endpoint](https://junglewise.ai/threats/cve-2026-66738-spip-code-injection-in-navigation-endpoint) (high, CVSS 8.8, published 10 Aug 2026) - [CVE-2026-8429: SPIP remote code execution in private space](https://junglewise.ai/threats/cve-2026-8429-spip-remote-code-execution-in-private-space) (high, CVSS 8.8, published 12 May 2026) - [CVE-2016-7998: SPIP remote PHP code execution in template compiler](https://junglewise.ai/threats/cve-2016-7998-spip-remote-php-code-execution-in-template-compiler) (high, CVSS 8.8, published 18 Jan 2017) - [CVE-2016-7980: SPIP CSRF in XML validator](https://junglewise.ai/threats/cve-2016-7980-spip-csrf-in-xml-validator) (high, CVSS 8.8, published 18 Jan 2017) - [CVE-2026-8430: SPIP remote code execution in public space via Nginx](https://junglewise.ai/threats/cve-2026-8430-spip-remote-code-execution-in-public-space-via-nginx) (high, CVSS 8.1, published 12 May 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 2 | 2 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 3 | 2 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 1 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Spip technologies - [Spip](https://junglewise.ai/threats/technologies/spip): 16 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Spip vulnerabilities", https://junglewise.ai/threats/vendors/spip, 12 November 2026.