CVE-2026-72710

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18

Description A mass assignment issue exists in the editer objet action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a champs editables allowlist by providing a controlled arg parameter that resolves to internal database tables. This allows an attacker to insert a malicious row into the spip jobs queue containing a specific PHP function and arguments. When the cron process handles the queue, the injected function is dynamically executed, leading to remote code execution.

Recommendations Update SPIP to version 4.4.18 or later.