CVE-2026-72710: SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection
SPIP before 4.4.18 contains a remote code execution vulnerability in the editerobjet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spipjobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SPIPto a version that resolves this vulnerability.Fixed in 4.4.18 - Configuration
Update SPIP so that the editer_objet action resolves SQL table names only after enforcing an editable columns allowlist, preventing injection into the spip_jobs table (RCE when the cron job queue is drained).
SPIP editer_objet.php (editer_objet action) arg parameter resolution (editable columns allowlist enforcement) = enforce an editable columns allowlist
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
An attacker needs a valid nonce and must be able to submit a request to the editer_objet action using arg=job/0 with crafted fonction and args values. No additional privileges or user interaction are identified in the provided data.
When does the injected payload execute?
The crafted job is stored in the spip_jobs table and executes when the cron job queue is drained. At that point, the supplied values are unserialized and can result in arbitrary PHP function execution on the underlying system.
Which installations are affected?
SPIP versions earlier than 4.4.18 are affected according to the provided information. The data does not state whether any specific configuration changes, plugins, or deployment modes are required.