CVE-2026-72708

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

SPIP SPIP

CVSS

8.7High

ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Sep 2026. Not in the KEV catalogCISA via CVE List

Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 24 Oct 2026FIRST EPSS

Fixed in4.4.18Fixed versionCVE List

Published11 Sep 2026Updated 12 Oct 2026CVE List

What fixes it

4.4.18SPIPCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

11 Sep 2026, 16:37 UTCPublishedCVE List
25 Oct 2026, 02:03 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

ka3n1x/spip-cve-2026: PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18GitHub proof-of-concept repositories, 25 Oct 2026Exploit code

Description

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.

Text from CVE List

Affected versions 1

SPIPaffected: all versions before 4.4.18CVE List