CVE-2026-104070 Overview
CVE-2026-104070 is a missing authorization vulnerability [CWE-862] in the Crayons plugin for SPIP before version 3.5.0. The flaw resides in crayons_store.php, where omitting the secu_ anti-forgery parameter causes the authorization dispatcher to resolve an unconditionally-true handler instead of the intended modification check. Unauthenticated remote attackers can modify arbitrary editable object fields and chain the primitive into full remote code execution. By writing a malicious .html skeleton file, disclosing the site secret from configuration files, and forging a signed ajax context, an attacker executes arbitrary PHP as the web-server user.
Critical Impact
Unauthenticated remote code execution as the web-server user on SPIP sites running the vulnerable Crayons plugin.
Affected Products
- SPIP Crayons plugin versions prior to 3.5.0
- SPIP installations with the Crayons plugin enabled
- Web applications relying on the Crayons secu_ dispatcher for inline editing authorization
Discovery Timeline
- 2026-10-06 - CVE-2026-104070 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104070
Vulnerability Analysis
The Crayons plugin provides inline editing for SPIP editorial objects through the crayons_store.php endpoint. The endpoint relies on an authorization dispatcher that selects a handler based on the presence of the secu_ anti-forgery token in the request. When the parameter is absent, the dispatcher falls back to a handler that returns true unconditionally, bypassing the modification access check entirely.
With authorization neutralized, an unauthenticated attacker can submit arbitrary field writes to any editable object. The write primitive extends to template skeleton files, which SPIP compiles and executes server-side. Attackers chain the primitive in three steps: write a malicious .html skeleton, read configuration files containing the SPIP site secret, and craft a signed ajax context that triggers execution of the planted skeleton.
The outcome is arbitrary PHP code execution in the context of the web-server process, enabling data theft, lateral movement, and persistence on the host.
Root Cause
The root cause is improper authorization logic [CWE-862] in the secu_-driven dispatcher. The dispatcher conflates "no token supplied" with "no restricted action requested" and resolves to a permissive handler. The modification path should enforce the authorization check regardless of token presence.
Attack Vector
Exploitation requires only network access to the SPIP site and no authentication or user interaction. The attacker sends crafted HTTP requests to crayons_store.php without the secu_ parameter to trigger the authorization bypass. See the VulnCheck SPIP Crayons Advisory for the chained exploitation flow and the SPIP Security Update Blog for vendor guidance.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104070
Indicators of Compromise
- HTTP POST requests to crayons_store.php that omit the secu_ parameter yet carry object modification fields.
- Newly created or modified .html skeleton files in SPIP template directories with unexpected PHP constructs.
- Web server reads of SPIP configuration files containing the site secret from unauthenticated sessions.
- Outbound connections or process launches from the PHP worker process immediately after suspicious crayons_store.php requests.
Detection Strategies
- Alert on web access logs showing requests to crayons_store.php without the secu_ parameter, especially from unauthenticated clients.
- Monitor file integrity for template and skeleton directories under the SPIP document root for unexpected writes.
- Correlate PHP execution events with recent template modifications to surface compile-and-execute chains.
Monitoring Recommendations
- Enable verbose access logging on SPIP endpoints and forward logs to a central analytics platform for retention and querying.
- Baseline normal process behavior of the PHP-FPM or Apache worker and alert on child processes such as shells or network tools.
- Track outbound DNS and HTTP traffic from the web server to identify command-and-control activity following suspected exploitation.
How to Mitigate CVE-2026-104070
Immediate Actions Required
- Upgrade the Crayons plugin to version 3.5.0 or later on every SPIP instance.
- Audit SPIP template and skeleton directories for unauthorized .html files written since the plugin was first installed.
- Rotate the SPIP site secret and any credentials stored in configuration files that may have been disclosed.
Patch Information
The SPIP project released Crayons 3.5.0 to address the missing authorization in crayons_store.php. Administrators should apply the update through the SPIP plugin manager or by replacing the plugin files from the official repository. Refer to the SPIP Security Update Blog for release notes and to the SPIP Crayons Plugin Overview for distribution.
Workarounds
- Disable the Crayons plugin until the patched version can be installed.
- Block external requests to crayons_store.php at a reverse proxy or web application firewall when the plugin cannot be removed.
- Enforce authenticated access to all SPIP administrative paths through network-level controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
