Which versions of SPIP are affected by CVE-2026-66738?

SPIP content management system versions before 4.4.18 contain a vulnerability allowing editor-level users to execute arbitrary operating system commands on affected servers.. A patch is available.

How to fix or mitigate CVE-2026-66738?

Within 24 hours, identify all SPIP installations using SQLite backends to determine exposure scope. Within 7 days, apply vendor-released patch to upgrade affected SPIP instances to version 4.4.18 or later, and audit editor-level user accounts for unauthorized creation or privilege escalation. Within 30 days, review web server access logs for exploitation attempts targeting the /ecrire/?exec=navigation endpoint and confirm patch deployment across all production and non-production environments.

SPIP CVE-2026-66738

Q: What is the CVSS score of CVE-2026-66738?

CVE-2026-66738 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-55655 HIGH

Code Injection (CWE-94)

2026-08-10 VulnCheck

GHSA-ghch-c3xx-8rq5

RCE Code Injection Spip

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

SQLite-only backend requirement maps to AC:H; editor authentication maps to PR:L; OS command execution escapes the application to the OS level, warranting S:C.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 17:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Aug 10, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Aug 10, 2026 - 17:22 NVD

9.2 (CRITICAL) 7.7 (HIGH)

Patch available

Aug 10, 2026 - 17:03 EUVD

Analysis Generated

Aug 10, 2026 - 16:06 vuln.today

CVE Published

Aug 10, 2026 - 15:41 cve.org

CRITICAL 9.2

DescriptionCVE.org

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.

AnalysisAI

Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. MySQL-backed deployments are not affected; no public exploit has been identified at time of analysis.

Technical ContextAI

SPIP is a PHP-based open-source content management system widely used in French-speaking public sector and educational environments. The vulnerability (CWE-94: Improper Control of Generation of Code) resides in the navigation menu endpoint (/ecrire/?exec=navigation), which processes user-supplied GET parameters that may be of array type. When PHP evaluates these parameters within an internal quoted string context, array-typed values bypass SPIP's input sanitization and allow the attacker to escape the string boundary, injecting arbitrary PHP or OS-level commands. The flaw is SQLite-specific because the underlying data handling and string quoting behavior differ from MySQL; MySQL-backed deployments are architecturally unaffected. The CPE identifier cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* covers all SPIP versions prior to 4.4.18.

RemediationAI

Upgrade to SPIP 4.4.18 immediately; the vendor has published a critical security update documented at https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html, and additional technical context is available via the VulnCheck advisory at https://www.vulncheck.com/advisories/spip-code-injection-via-navigation-endpoint-on-sqlite. If an immediate upgrade is not feasible, migrating the SPIP database backend from SQLite to MySQL completely eliminates the vulnerable code path with no functional trade-offs for most deployments, though the migration requires a database export and reconfiguration step. As a compensating network control, restrict access to the /ecrire/ administrative interface to trusted IP ranges via web server ACL or firewall rules, which reduces the reachable attack surface but does not protect against an already-compromised editor account with internal network access. Audit editor-level (redacteur) accounts and revoke unnecessary elevated access while the patch is being applied.