CVE-2026-66738: SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SPIPto a version that resolves this vulnerability.Fixed in 4.4.18 - Compensating control
For SQLite-backed SPIP installations, mitigate the vulnerability by ensuring the endpoint /ecrire/?exec=navigation is not reachable by untrusted users (e.g., restrict access so only trusted roles/sessions can access it).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66738?
CVE-2026-66738 has a critical severity rating of 9.8.
How do I fix CVE-2026-66738?
To fix CVE-2026-66738, you should upgrade to SPIP version 4.4.18 or later.
What type of vulnerability is CVE-2026-66738?
CVE-2026-66738 is a code injection vulnerability specifically affecting SQLite-backed installations of SPIP.
What versions of SPIP are affected by CVE-2026-66738?
CVE-2026-66738 affects all versions of SPIP prior to 4.4.18.
What are the potential impacts of CVE-2026-66738?
Exploitation of CVE-2026-66738 can lead to arbitrary code execution and data compromise due to improper input sanitization.