CVE-2026-104070

Name of the Vulnerable Software and Affected Versions Crayons plugin for SPIP versions prior to 3.5.0

Description A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the secu anti-forgery parameter is omitted in the 'crayons store.php' endpoint, causing the authorization dispatcher to resolve an unconditionally-true handler instead of performing the proper modification check. This flaw can be chained to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, resulting in arbitrary PHP code execution as the web-server user.

Recommendations Update the Crayons plugin for SPIP to version 3.5.0 or later.