Loading vulnerability…
CVE-2026-72710 is a remote code execution vulnerability in SPIP versions before 4.4.18. The editer_objet action permits its object-resolution parameter to select SQL table names without enforcing an allowlist of editable columns. An attacker with a valid nonce can create attacker-controlled records in the SPIP job queue, including function and serialized argument fields. When the cron queue subsequently processes the malicious job, the stored data is unserialized and the attacker-selected PHP function can be executed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in SPIP before 4.4.18. An attacker holding a valid nonce can use the editer_objet action with arg=job/0 to inject crafted fonction and args values into the spip_jobs table; when the cron queue is drained, the values are unserialized and can cause arbitrary PHP function execution.
A critical unauthenticated remote code execution vulnerability in SPIP before version 4.4.18. Improper validation in the editer_objet action permits injection of crafted job-queue entries; when the queue is drained, attacker-controlled serialized values can cause arbitrary PHP function execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.