Loading story…
SPIP released version 4.4.18 as a critical security update to remediate multiple vulnerabilities affecting the CMS, including an unauthenticated SQL injection, unauthorized access to the editer_objet API, unauthorized author account modification, remote code execution through spip_jobs after SQL injection, code injection in the private area, and SSRF via redirection during remote content retrieval. SPIP said these issues are not mitigated by the SPIP security screen and added hardening measures such as job signing, stricter authorization checks for sensitive account fields, path traversal protections in find_in_path(), improved URL validation, and tighter restrictions on forum comment models.
A separate high-severity flaw, tracked as CVE-2026-66738, affects SPIP versions prior to 4.4.18 when deployed with SQLite. The bug in the /ecrire/?exec=navigation endpoint lets an authenticated user with editor-level access supply crafted array input that bypasses sanitization, escapes an internally quoted PHP string during evaluation, and can result in arbitrary OS command execution; MySQL-backed installations are not affected. SPIP said administrators upgrading without spip_loader must complete a database update through the private area.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-66738 was updated to change the privilege requirement in both CVSS v3.1 and v4.0 from none to low, reflecting that exploitation requires an authenticated editor-level user. The record describes a code injection flaw in SPIP before 4.4.18 affecting SQLite-backed installations via the /ecrire/?exec=navigation endpoint.
SPIP released version 4.4.18 as a critical security update fixing multiple vulnerabilities, including unauthenticated SQL injection, SQLi-driven unauthorized API access and account modification, remote code execution via spip_jobs, code injection in the private area, and SSRF via redirection. The notice also states these issues are not mitigated by the SPIP security screen and includes additional hardening changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SPIP issued back-to-back critical security updates after disclosing a **pre-authentication remote code execution** flaw that can be exploited against public-facing sites through the `X-Spip-Filtre` HTTP header. The project first released **SPIP 4.4.20** to address a universally exploitable issue affecting all versions, then followed with **SPIP 4.4.21** after determining that version `4.4.20` itself remained vulnerable. SPIP said the bug was reported anonymously via **ANSSI**, warned that exploitation attempts had already been observed in the wild, and stressed that the platform’s security screen does **not** mitigate the issue. The vulnerability is tracked as **`CVE-2026-77806`** and affects SPIP versions before `4.4.21`, with a CVSS 3.1 score reflecting critical impact (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`). Rapid7 also added a Metasploit module for related exploitation of the `X-Spip-Filtre` mechanism, describing unauthenticated code execution via function-call injection in SPIP’s template engine and command execution through a crafted POST request. Administrators were urged to update immediately to **SPIP 4.4.21**, with SPIP recommending upgrades via **`spip_loader` 7.0.0**.
Aug 28, 2026
A **critical unauthenticated remote code execution (RCE)** flaw, tracked as **CVE-2025-71243**, was disclosed in the SPIP *Saisies pour formulaire* (*Saisies*) plugin affecting versions **5.4.0 through 5.11.0**. The issue is categorized as **CWE-94 (code injection)** and allows an attacker to execute arbitrary code on the server; remediation is to **upgrade to Saisies 5.11.1 or later**. Technical analysis indicates exploitation is possible via **PHP code injection** through the `_anciennes_valeurs` form parameter, where attacker-controlled input is interpolated into a PHP template rendered with `interdire_scripts=false`, enabling `<?php ... ?>` execution server-side. Separately, SPIP core also received a high-severity security fix for **CVE-2025-71250**, an **insecure deserialization** issue (CWE-502) in SPIP versions **before 4.4.9** involving the `table_valeur` filter and the `DATA` iterator accepting serialized data. This deserialization weakness requires a precondition (the attacker must be able to place malicious serialized content via prior access or another vulnerability) and is noted as **not mitigated by the SPIP security screen**; the use of serialized data in these components is deprecated and planned for removal in SPIP 5. While both items affect the SPIP ecosystem, they are distinct vulnerabilities with different affected components, prerequisites, and fixes.
Jun 29, 2026
Two high-severity vulnerabilities in **CI4MS**, a CodeIgniter 4-based CMS skeleton, allow authenticated low-privilege users to trigger **stored DOM-based XSS** that can lead to full account takeover across roles and privilege escalation. **`CVE-2026-34558`** affects the **Methods Management** functionality, where improperly sanitized and encoded user input can be stored server-side and later executed in administrative interfaces and global navigation components. A second flaw, **`CVE-2026-34565`**, impacts **Menu Management** for posts, where malicious post data added to navigation menus can execute in both admin dashboards and public-facing menus. Both issues are classified as **CWE-79** and carry the same **CVSS v3.1** vector, `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`; they affect CI4MS versions prior to **`0.31.0.0`** and were patched in **`0.31.0.0`**.
Jun 29, 2026