CVE-2026-72710

Deferred Deferred - Pending Action

SPIP Remote Code Execution via Unserialization in Job Queue

Publication date: 2026-09-11

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs_editables allowlist by supplying an attacker-controlled arg parameter resolving to internal database tables. Attackers can insert a malicious row into the spip_jobs queue with a controlled PHP function and arguments, which is then dynamically executed when the cron processes the queue, resulting in remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-15

Generated

2026-10-02

AI Q&A

2026-09-11

EPSS Evaluated

2026-10-01

NVD

CVE-2026-72710

EUVD

EUVD-2026-76156

Affected Vendors & Products

Vendor	Product	Version / Range
spip	spip	to 4.4.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

SPIP before 4.4.18 has a remote code execution vulnerability in the editer_objet action. The arg parameter allows SQL table name resolution without checking if columns are editable. Attackers with a valid nonce can inject rows into the spip_jobs table by setting arg=job/0 and providing malicious fonction and args values. These values are unserialized and executed when the cron job queue runs, leading to arbitrary PHP code execution on the system.

Detection Guidance

Check SPIP version with command: grep -r 'define.*SPIP_VERSION' /path/to/spip/config. If version is below 4.4.18, the system is vulnerable. Inspect web server logs for requests to editer_objet.php with arg=job/0 and unusual fonction/args parameters. Monitor spip_jobs table for unexpected entries using SQL query: SELECT * FROM spip_jobs WHERE fonction LIKE '%arbitrary_function%';

Look for cron job execution logs for unexpected PHP function calls. Check for unauthorized file modifications in SPIP directories. Use network monitoring tools to detect outbound connections from the web server to unexpected destinations.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the affected system with the privileges of the SPIP application. This could lead to complete system compromise, data theft, unauthorized access, or further network infiltration. Any system running a vulnerable SPIP version is at risk if exposed to an attacker with a valid nonce.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited. Immediate patching is critical to maintain regulatory compliance.

Mitigation Strategies

Immediately update SPIP to version 4.4.18 or later to patch the vulnerability. If updating is not immediately possible, restrict access to the editer_objet action and validate all inputs to prevent SQL table name resolution without an allowlist.

Hi! I’m here to help you understand CVE-2026-72710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70