CVE-2026-72710: SPIP Mass Assignment RCE Vulnerability

CVE-2026-72710 Overview

CVE-2026-72710 is a mass assignment vulnerability [CWE-915] in SPIP versions prior to 4.4.18. The flaw resides in the editer_objet action, which fails to enforce a champs_editables allowlist for arbitrary SQL tables. Unauthenticated attackers can supply a controlled arg parameter that resolves to internal database tables and write arbitrary rows. By injecting a malicious row into the spip_jobs queue with a controlled PHP function and arguments, attackers achieve remote code execution when the cron processes the queue.

Critical Impact
Unauthenticated remote code execution on SPIP content management system installations through SQL job queue injection.

Affected Products

SPIP versions prior to 4.4.18
SPIP installations exposing the editer_objet action to unauthenticated users
SPIP deployments with the cron job queue processor enabled

Discovery Timeline

2026-09-11 - CVE-2026-72710 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-72710

Vulnerability Analysis

The vulnerability resides in SPIP's editer_objet action, a generic handler used to edit objects across the content management system. The handler accepts an arg parameter that determines which database table the action targets. SPIP applies a champs_editables allowlist to constrain which fields users can modify. Tables lacking this allowlist accept arbitrary column writes from user-supplied input.

Attackers exploit this gap by resolving arg to internal tables that were never intended for user-facing editing. The most impactful target is spip_jobs, SPIP's asynchronous job queue table. Rows in spip_jobs describe deferred PHP functions and their arguments. The scheduler dynamically invokes these functions when the cron runs, converting a SQL row write into arbitrary code execution.

The attack chain requires no authentication. See the Lexfo Blog SQLi to RCE Analysis and the VulnCheck Remote Code Execution Advisory for full exploitation details.

Root Cause

The root cause is missing input validation on the arg parameter combined with the absence of a champs_editables allowlist on sensitive tables like spip_jobs. SPIP treats any table without an explicit allowlist as fully writable, violating a secure-by-default posture. This is a textbook mass assignment flaw classified under [CWE-915].

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the editer_objet endpoint. The request sets arg to reference spip_jobs and supplies attacker-controlled values for the fonction and args columns. SPIP inserts the row without validation. When the SPIP cron scheduler next processes the queue, it dynamically invokes the attacker-specified PHP function with the attacker-specified arguments, yielding remote code execution under the web server user context.

Detection Methods for CVE-2026-72710

Indicators of Compromise

Unexpected rows in the spip_jobs table referencing PHP functions such as system, exec, passthru, shell_exec, or assert
HTTP POST requests to editer_objet endpoints containing an arg parameter that resolves to internal tables like spip_jobs
Web server processes spawning shell interpreters or outbound connections shortly after cron execution
New or modified PHP files in SPIP webroot directories following suspicious request activity

Detection Strategies

Audit SPIP database logs for INSERT statements into spip_jobs originating from web request contexts rather than legitimate scheduled tasks
Inspect HTTP access logs for requests to ecrire/?exec=editer_objet or equivalent action endpoints containing unusual arg values
Correlate cron execution timestamps with anomalous child process creation on hosts running SPIP

Monitoring Recommendations

Enable query-level logging on the SPIP database and alert on writes to spip_jobs outside of expected application flows
Monitor the SPIP webroot filesystem for unauthorized file creation or modification using integrity monitoring
Track outbound network connections from PHP-FPM or Apache worker processes to identify post-exploitation callbacks

How to Mitigate CVE-2026-72710

Immediate Actions Required

Upgrade SPIP to version 4.4.18 or later immediately, following the SPIP Security Update Advisory
Inspect the spip_jobs table for suspicious entries and purge any rows referencing dangerous PHP functions
Review web server access logs for prior exploitation attempts against editer_objet
Rotate credentials and secrets stored on the affected host if compromise is suspected

Patch Information

SPIP resolved the vulnerability in version 4.4.18. The patch enforces field-level allowlists on the editer_objet action and restricts the tables reachable through the arg parameter. Administrators should apply the upstream release rather than attempting to backport fixes manually. Refer to the SPIP Security Update Advisory for release notes.

Workarounds

Block unauthenticated access to editer_objet at the reverse proxy or web application firewall layer until patching is complete
Disable the SPIP cron job processor temporarily to prevent execution of any injected spip_jobs rows
Restrict database privileges of the SPIP application user to reduce write access to sensitive internal tables where feasible

bash

# Example WAF rule to block editer_objet requests referencing spip_jobs
# ModSecurity syntax
SecRule ARGS:arg "@rx (spip_jobs|spip_meta|spip_auteurs)" \
  "id:1072710,phase:2,deny,status:403,\
  msg:'CVE-2026-72710 SPIP editer_objet mass assignment attempt'"