SPIP CVE-2026-72710

Exploitation targets the editer_objet action of a network-reachable SPIP instance running a version before 4.4.18, and requires the attacker to possess a valid nonce for that action; the request supplies arg=job/0 with attacker-chosen fonction and args fields to write into the spip_jobs table. Code execution does not occur on the request itself but is triggered later when SPIP's cron/job queue is processed, so a functioning job scheduler must be active. The valid-nonce requirement is the main limiting factor and is not reflected in the PR:N CVSS metric; if nonces are only reachable by an authenticated editor, the practical privilege bar is higher than 'unauthenticated' - verify against the vendor advisory.

This is a genuine high-priority issue, not a paper-tiger high score. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H, 9.3) describes a network-reachable path with full confidentiality/integrity/availability impact, and publicly available exploit code plus a detailed SQLi-to-RCE write-up materially raise real-world risk. The one tempering factor is the description's requirement for a 'valid nonce', which the PR:N/AC:L metrics do not capture; SPIP nonces are per-action tokens, so the true difficulty depends on how easily an unauthenticated attacker can obtain a usable nonce - worth verifying against the vendor advisory. There is no CISA KEV listing and no EPSS figure supplied, so this is not confirmed as mass-exploited, but given working public exploit code any exposed SPIP instance should be patched immediately rather than waiting for widespread scanning. Even a mid-sized operator running a single public SPIP site should treat this as urgent.

An attacker obtains a valid nonce for the editer_objet action and sends a crafted request with arg=job/0 plus fonction and args values pointing at a dangerous PHP function; the request writes a malicious row into spip_jobs. When SPIP's cron drains the queue, the serialized payload is unserialized and the function executes, giving arbitrary PHP execution on the host. A public proof-of-concept demonstrating this SQLi-to-RCE chain is available in the Lexfo blog post.