CVE-2026-72710
CRITICAL · 9.8 EPSS 0.6%Claimed public PoC unverified; automated posts recycle metadata; no KEV, no exploitation confirmation.
What: SPIP CMS before 4.4.18 remote code execution via SQL table injection in editer_objet action; requires valid nonce; CVSS 9.8 CRITICAL.
Why it matters: Published yesterday; CVSS 9.8 and claimed public PoC raise urgency. Not yet KEV-listed. Social chatter is near-identical automated feeds citing "public exploit" without independent verification of working code or in-the-wild use. No vendor advisory or defender triage signals observed.
Where it's seen: Repetitive Bluesky posts amplifying vulnerability metadata; no substantive discussion, PoC repositories, or SPIP team advisory visible.
RISK: HIGH — CVSS 9.8, requires nonce but enables arbitrary PHP execution via cron deserialization.
Description
SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High