SQL Injection Vulnerability in SPIP by SPIP
CVE-2026-22206

8.7HIGH

Key Information:

Vendor

Spip

Status
Spip
Vendor
CVE Published:
26 February 2026

What is CVE-2026-22206?

Versions of SPIP prior to 4.4.10 are susceptible to a SQL injection vulnerability that enables authenticated low-privilege users to execute arbitrary SQL queries through manipulation of union-based injection techniques. When exploited, this vulnerability may allow attackers to leverage PHP tag processing to execute remote code on the server, posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SPIP 0 < 4.4.10

References

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-S...
vendor-advisorypatch
https://git.spip.net/spip/spip
product
https://www.vulncheck.com/advisories/spip-sql-injection-r...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arthur Deloffre (Vozec)
Louka Jacques-Chevallier (Laluka)
JSON
.