CVE-2026-72708

HIGH 7.5

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.

CWE	CWE-89
Vendor	spip
Product	spip
Published	Sep 11, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for spip spip

Be the first to know when new high vulnerabilities affecting spip spip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

SPIP / SPIP

0 < 4.4.18

References

NVD ↗ CVE.org ↗ EPSS Data ↗

blog.lexfo.fr: https://blog.lexfo.fr/casse-spip-sqli-to-rce.html blog.spip.net: https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html vulncheck.com: https://www.vulncheck.com/advisories/spip-unauthenticated-sql-injection-via-sitemap-annee-parameter

Credits

Franck Chevalier (Wayko)