Advisory analysisVulnCheckSource: EIP research review
SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite | Advisories | VulnCheck
VulnCheck advisory details CVE-2026-66738, a code injection vulnerability in SPIP before 4.4.18 affecting only SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, bypassing sanitization and allowing breakout from a quoted string context when evaluated as PHP. An authenticated attacker with editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected. Fixed in SPIP 4.4.18. Credited to Benoit Hua of Fenrisk.
Root causeTechnical detail
https://www.vulncheck.com/advisories/spip-code-injection-via-navigation-endpoint-on-sqlite Research notes
- Root causeThe navigation menu endpoint improperly handles array-typed user input, bypassing sanitization and allowing the value to break out of a quoted string context when evaluated as PHP code.
- Technical detailExploitation requires authenticated editor privileges and a single crafted GET request to /ecrire/?exec=navigation; only SQLite-backed installations are affected, MySQL is not.
Supporting sources