Description

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T16:19:48.607Z",
  "pubdate": "2026-08-10T16:19:48.607Z",
  "executiveSummary": "SPIP before 4.4.18 suffers from a critical code injection vulnerability affecting SQLite-backed installations. The flaw resides in the navigation menu endpoint, which improperly handles array-typed user input, allowing malicious payloads to bypass sanitization mechanisms and break out of an internal quoted string context during PHP evaluation.\nThe vulnerability allows an authenticated attacker possessing at minimum editor (redacteur) privileges to achieve arbitrary OS command execution within the context of the web server process by submitting a single crafted GET request to the vulnerable endpoint.\nMySQL-backed installations of SPIP are not affected by this specific issue due to differences in database backend handling. The risk implication is severe, as successful exploitation results in complete compromise of the underlying web server application layer.\nExploitation requires authenticated access with editor-level privileges and targeted interaction with the navigation management functionality of the application.",
  "technicalDetails": "The vulnerability stems from improper input validation and type handling within the navigation menu endpoint of SPIP. Specifically, when the application processes user-supplied input submitted via the navigation interface, it fails to adequately sanitize array-typed data structures.\nIn SQLite-backed installations, this unsanitized array input is subsequently concatenated or evaluated within an internal quoted string context during PHP execution. Because the application does not enforce strict type checks or proper contextual escaping for array parameters, an attacker can supply a specially crafted array structure that breaks out of the intended string context.\nThe attack flow proceeds as follows: First, an authenticated attacker with editor (redacteur) privileges interacts with the application. The attacker crafts an HTTP GET request directed to the vulnerable endpoint located at /ecrire/?exec=navigation, injecting the malicious payload into the parameters handled by the navigation menu logic.\nSecond, the backend code processes the request, evaluating the unsanitized array input in a PHP evaluation context. The payload successfully breaks out of the internal quoted string due to insufficient boundary enforcement.\nThird, the injected code is interpreted and executed by the PHP engine running within the web server process, leading directly to arbitrary OS command execution.\nThe vulnerable component is the navigation menu endpoint (/ecrire/?exec=navigation) specifically in SPIP versions prior to 4.4.18 utilizing SQLite as the database backend. The exploitation vector requires network access to the administrative interface, valid credentials granting at minimum editor (redacteur) privileges, and the specific database configuration."
}