Remote Code Execution in SPIP SQLite Installations via CVE-2026-66738

SPIP versions prior to 4.4.18 are vulnerable to a remote code execution vulnerability identified as CVE-2026-66738. The flaw specifically impacts installations utilizing SQLite as a backend database. The vulnerability exists within the navigation menu functionality reachable via the /ecrire/?exec=navigation endpoint.

An authenticated attacker with at minimum editor (redacteur) privileges can exploit this by providing crafted array-typed input to the endpoint. This input bypasses existing sanitization mechanisms, allowing the payload to break out of the intended quoted string context during PHP evaluation. Successful exploitation results in arbitrary command execution within the context of the web server process. This vulnerability does not impact MySQL-backed installations, limiting the attack surface to specific SPIP deployment configurations. Given the requirement for editor-level access, this threat is particularly relevant to environments where administrative or editorial accounts may be compromised via secondary vectors such as session hijacking or credential theft.

Impact

Successful exploitation of CVE-2026-66738 allows an authenticated attacker to execute arbitrary OS commands, potentially leading to full system compromise of the web server. This provides the attacker the ability to exfiltrate sensitive data, install persistent backdoors, or pivot into the internal network. The impact is significant for organizations relying on SQLite-backed SPIP instances for their web presence.

Recommendation

• Immediately upgrade all SPIP installations to version 4.4.18 or later to remediate CVE-2026-66738.
• Audit access logs for the /ecrire/?exec=navigation endpoint to identify potential exploitation attempts, specifically looking for array-typed query parameters.
• Audit editor-level account activity for anomalous access to administrative endpoints.
• If upgrading is not immediately possible, consider migrating SQLite-backed SPIP instances to a MySQL backend, as the reported vulnerability is specific to the SQLite implementation.