CVE-2026-72708 Details
Description
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.
A blind SQL injection vulnerability has been identified in SPIP versions prior to 4.4.18. This vulnerability exists in the SQL escaping layer and allows unauthenticated attackers to inject arbitrary SQL by crafting the 'annee' parameter value to match a specific pattern. The injection bypasses SQL escaping for date-type columns in MySQL, SQLite, and PostgreSQL databases. Exploitation of this vulnerability enables the extraction of sensitive database information, including the 'alea_ephemere' secret used for signing SPIP action nonces. The vulnerability can be exploited through the 'sitemap.xml.html' template, which is always present.
Users can update to SPIP version 4.4.18, which addresses this vulnerability by applying proper SQL escaping, restoring authorization checks for sensitive actions, and fixing the access control flaws that allowed for the exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.lexfo.fr/casse-spip-sqli-to-rce.html | [email protected] | BundleExploitTechnical Analysis |
| https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/spip-unauthenticated-sql-injection-via-sitemap-annee-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SPIP | < 4.4.18 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | CVE Modified | [email protected] |
| Sep 11, 2026 | New CVE Received | [email protected] |