Benoit Hua

**Name of the Vulnerable Software and Affected Versions** SPIP versions prior to 4.4.18 **Description** In installations using SQLite, the navigation menu endpoint improperly handles array-typed user input. This flaw bypasses input sanitization, allowing the input to break out of an internal quoted string context during PHP evaluation. An authenticated attacker with at least editor (redacteur) privileges can execute arbitrary OS commands in the web server process by sending a crafted GET request to the '/ecrire/?exec=navigation' endpoint. MySQL-backed installations are not affected. **Recommendations** Update SPIP to version 4.4.18 or later.