Skip to main content

SPIP EUVDEUVD-2026-55655

| CVE-2026-66738 HIGH
Code Injection (CWE-94)
2026-08-10 VulnCheck GHSA-ghch-c3xx-8rq5
Code Injection RCE Spip
7.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.7 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.5 HIGH

SQLite-only backend requirement maps to AC:H; editor authentication maps to PR:L; OS command execution escapes the application to the OS level, warranting S:C.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Aug 10, 2026 - 17:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 10, 2026 - 17:22 vuln.today
cvss_changed
Severity Changed
Aug 10, 2026 - 17:22 NVD
CRITICAL HIGH
CVSS changed
Aug 10, 2026 - 17:22 NVD
9.2 (CRITICAL) 7.7 (HIGH)
Patch available
Aug 10, 2026 - 17:03 EUVD
Analysis Generated
Aug 10, 2026 - 16:06 vuln.today
CVE Published
Aug 10, 2026 - 15:41 cve.org
CRITICAL 9.2

DescriptionCVE.org

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.

AnalysisAI

Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain editor-level SPIP credentials
Delivery
Send crafted GET request to /ecrire/?exec=navigation
Exploit
Array-typed input bypasses string sanitization
Execution
Escape PHP internal quoted string context
Impact
Execute arbitrary OS commands as web server user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two simultaneous conditions: first, the SPIP installation must use SQLite as its database backend - MySQL-backed installations are not affected regardless of version or patch level; second, the attacker must hold at minimum editor (redacteur)-level credentials within the SPIP application - anonymous or unauthenticated access is insufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.7 (High) is shaped by a network attack vector, low attack complexity, but the presence of specific attack requirements (AT:P) reflecting the SQLite-only condition, and PR:L reflecting the editor-level authentication prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained editor-level credentials through phishing, credential stuffing, or a compromised account submits a single crafted GET request to /ecrire/?exec=navigation containing array-typed parameters engineered to escape SPIP's internal PHP string evaluation context. The injected payload executes as OS commands under the identity of the web server process, granting arbitrary code execution, potential access to configuration files including database credentials, and the ability to pivot further within the host. …
Remediation Upgrade to SPIP 4.4.18 immediately; the vendor has published a critical security update documented at https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html, and additional technical context is available via the VulnCheck advisory at https://www.vulncheck.com/advisories/spip-code-injection-via-navigation-endpoint-on-sqlite. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all SPIP installations using SQLite backends to determine exposure scope. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Spip

View all
CVE-2013-4557 HIGH POC
7.5 Nov 18

The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, all
CVE-2016-7981 MEDIUM POC
6.1 Jan 18

Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject

CVE-2016-7982 HIGH POC
7.5 Jan 18

Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to en
CVE-2016-7998 HIGH POC
8.8 Jan 18

The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP
CVE-2024-8517 CRITICAL POC
9.8 Sep 06

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. Rated critical severity (CVSS 9.8), th
CVE-2023-27372 CRITICAL POC
9.8 Feb 28

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. R
CVE-2013-2118 HIGH POC
7.5 Jul 09

SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "ta
CVE-2023-24258 CRITICAL POC
9.8 Feb 27

SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. Rated critical

CVE-2016-7980 HIGH POC
8.8 Jan 18

Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote a
CVE-2022-37155 HIGH POC
8.8 Dec 14

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. Ra
CVE-2022-28961 HIGH POC
8.8 May 19

Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the
CVE-2022-28960 HIGH POC
8.8 May 19

A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups paramet

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-55655 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy