CVE-2026-66738: SPIP SQLite RCE Vulnerability

CVE-2026-66738 Overview

CVE-2026-66738 is a code injection vulnerability [CWE-94] in SPIP versions before 4.4.18 running on SQLite backends. The navigation menu endpoint at /ecrire/?exec=navigation mishandles array-typed user input, bypassing sanitization and breaking out of an internal quoted string context during PHP evaluation. An authenticated attacker with redacteur (editor) privileges or higher can submit a single crafted GET request to execute arbitrary operating system commands in the web server process. MySQL-backed installations are not affected by this issue.

Critical Impact

Authenticated editor-level users can achieve remote code execution on the web server via a single GET request against SQLite-backed SPIP installations.

Affected Products

• SPIP versions prior to 4.4.18
• SPIP installations configured with SQLite database backend
• SPIP deployments exposing /ecrire/?exec=navigation to authenticated users

Discovery Timeline

• 2026-08-10 - CVE-2026-66738 published to NVD
• 2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-66738

Vulnerability Analysis

The vulnerability affects the SPIP content management system, a French open-source publishing platform. The navigation endpoint reachable at /ecrire/?exec=navigation accepts user-controlled parameters that are subsequently used within a PHP expression evaluated at runtime. When the SQLite database driver is active, the parameter handling path treats array-typed inputs differently than scalar strings, and the sanitization routine fails to normalize or reject array values before they reach a quoted-string context in generated PHP code.

Because the injected value escapes its surrounding quotes, an attacker can append arbitrary PHP expressions that execute in the context of the web server user. The requirement for redacteur privileges limits pre-authentication exposure but does not prevent exploitation on sites that accept editor registrations or that reuse credentials across users.

Root Cause

The root cause is improper input validation of array-typed parameters combined with unsafe construction of PHP code that is later evaluated. Sanitization logic assumes scalar string input, so PHP arrays passed via query parameters bypass escaping. The SQLite-specific code path uses this unsanitized value inside a quoted string that is later interpreted as PHP, satisfying the conditions for code injection [CWE-94].

Attack Vector

Exploitation occurs over the network via a single HTTP GET request to /ecrire/?exec=navigation with an array-formatted parameter (for example param[]=payload). The attacker must first authenticate with at least redacteur privileges. Successful requests execute attacker-supplied commands as the web server user, enabling web shell installation, credential theft, and lateral movement.

Refer to the VulnCheck Code Injection Advisory and the SPIP Security Update Announcement for additional technical detail.

Detection Methods for CVE-2026-66738

Indicators of Compromise

• GET requests to /ecrire/?exec=navigation containing array-style parameters such as name[]= or bracketed keys in the query string
• Web server processes spawning unexpected child processes such as sh, bash, python, perl, or curl
• New or modified PHP files under SPIP directories, particularly outside standard upload paths
• Outbound network connections from the SPIP web server host to unfamiliar external addresses following editor authentication events

Detection Strategies

• Inspect HTTP access logs for requests to exec=navigation where query parameters use array syntax and correlate with authenticated editor sessions
• Monitor process ancestry on the web server for shells or interpreters descending from php-fpm, apache2, or nginx worker processes
• Enable PHP audit logging for calls to system, exec, passthru, shell_exec, and eval from within SPIP request contexts

Monitoring Recommendations

• Alert on file integrity changes within the SPIP ecrire/ and web root directories
• Track successful authentications to /ecrire/ followed within seconds by navigation endpoint requests carrying array parameters
• Baseline outbound egress from the CMS host and alert on deviations, especially connections to raw IP addresses or non-standard ports

How to Mitigate CVE-2026-66738

Immediate Actions Required

• Upgrade SPIP to version 4.4.18 or later on all SQLite-backed installations
• Audit editor and administrator accounts and disable any that are inactive or unverified
• Review web server logs since the last patch cycle for prior exploitation attempts against /ecrire/?exec=navigation
• Rotate credentials and API keys accessible to the web server user if compromise is suspected

Patch Information

SPIP resolved this vulnerability in release 4.4.18. Details are available in the SPIP Security Update Announcement. Administrators running earlier 4.x branches should upgrade directly to 4.4.18 or later.

Workarounds

• Migrate the SPIP installation from SQLite to MySQL, which is not affected by this code path
• Restrict access to /ecrire/ using web server access controls, IP allowlists, or VPN-only reachability until patching is complete
• Temporarily revoke redacteur privileges from non-essential accounts to reduce the pool of users who can reach the vulnerable endpoint

# Example nginx restriction limiting /ecrire/ to a trusted management range
location /ecrire/ {
    allow 10.0.0.0/24;
    deny all;
    try_files $uri $uri/ /ecrire/index.php?$args;
}