Critical· 9.3official fix available
CVE-2026-72710
SPIP before version 4.4.18 is vulnerable to remote code execution via the editer_objet action. Attackers can inject PHP code that will run when the cron job queue processes. The flaw allows arbitrary code execution on the server.
publishedSep 11, 2026
last modifiedSep 11, 2026
sourcesNVD
severity · cvss
9.3
critical · how bad it is
exploitation · epss
<1%
47th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 11, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
SPIP content management system, versions earlier than 4.4.18, used by website administrators.
02
Real-world impact
An attacker can run arbitrary PHP code on the server, potentially taking full control of the website and underlying system.
03
Why this severity
The CVSS score of 9.3 reflects the high impact of remote code execution with no authentication or user interaction required, giving attackers full control.
04
What to do about it
official fix available
recommended steps
- 01Upgrade SPIP to version 4.4.18 or later.
NVD description
05
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 11, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →