Unauthenticated Blind SQL Injection in SPIP by SPIP Team
CVE-2026-72708

8.7HIGH

Key Information:

Vendor

Spip

Status
Spip
Vendor
CVE Published:
11 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-72708?

The vulnerability in SPIP affects earlier versions than 4.4.18, where an unauthenticated blind SQL injection exists in the public sitemap endpoint. This flaw occurs due to the MySQL escaper, spip_mysql_cite(), returning unescaped values when the target column type is date and the supplied value conforms to a specific pattern. Attackers can exploit this vulnerability by crafting a malicious input through the annee parameter in the sitemap's HTML template, allowing them to embed arbitrary SQL code into the generated query. This can enable both time-based and boolean-based blind SQL injection, potentially exposing sensitive database information, including the alea_ephemere secret used for signing action nonces.

Affected Version(s)

SPIP 0 < 4.4.18

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

spip-exploits
Created by ambionics

References

https://blog.lexfo.fr/casse-spip-sqli-to-rce.html
technical-descriptionexploit
https://blog.spip.net/Mise-a-jour-critique-de-securite-so...
release-notespatch
https://www.vulncheck.com/advisories/spip-unauthenticated...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Franck Chevalier
Wayko
.