CVE-2026-72710

SPIP versions before 4.4.18 contain a critical remote code execution vulnerability in the editer_objet action. The arg parameter resolves SQL table names without enforcing an editable-columns allowlist, allowing an attacker with a valid nonce to supply arg=job/0 with crafted fonction and args val...

CVE-2026-72710 SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection

SPIP before 4.4.18 contains a remote code execution vulnerability in the editerobjet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spipjobs table. Attackers...