Unauthenticated Blind SQL Injection in SPIP by SPIP Team

CVE-2026-72708

What is CVE-2026-72708?

The vulnerability in SPIP affects earlier versions than 4.4.18, where an unauthenticated blind SQL injection exists in the public sitemap endpoint. This flaw occurs due to the MySQL escaper, spip_mysql_cite(), returning unescaped values when the target column type is date and the supplied value conforms to a specific pattern. Attackers can exploit this vulnerability by crafting a malicious input through the annee parameter in the sitemap's HTML template, allowing them to embed arbitrary SQL code into the generated query. This can enable both time-based and boolean-based blind SQL injection, potentially exposing sensitive database information, including the alea_ephemere secret used for signing action nonces.

References