Unauthenticated RCE in SPIP Crayons Plugin via CVE-2026-104070

The Crayons plugin for SPIP, a content management system, contains a critical missing authorization vulnerability tracked as CVE-2026-104070. The vulnerability resides in 'crayons_store.php' and affects all versions prior to 3.5.0. By omitting the 'secu_' anti-forgery parameter, an unauthenticated attacker can force the authorization dispatcher to resolve an unconditionally-true handler. This bypass allows the attacker to modify arbitrary editable object fields within the SPIP installation. This vulnerability acts as a primitive for an escalation chain: attackers can use this access to write malicious '.html' skeleton files to the server, read site configuration files to extract the site secret, and ultimately sign a forged AJAX context to execute the uploaded malicious code, resulting in arbitrary PHP execution as the web-server user.

Attack Chain

1. Attacker sends a crafted HTTP POST request to 'crayons_store.php' omitting the 'secu_' parameter.
2. The application's authorization dispatcher incorrectly resolves to an 'unconditionally-true' handler.
3. Attacker leverages the authorization bypass to perform unauthorized modification of site objects.
4. Attacker utilizes the modification capability to write a malicious '.html' skeleton file to a directory accessible by the web server.
5. Attacker targets sensitive configuration files to read and disclose the site secret key.
6. Attacker uses the disclosed site secret to sign a forged AJAX request.
7. Attacker executes the signed request to trigger the previously uploaded malicious skeleton file.
8. PHP code within the malicious skeleton is executed, granting the attacker arbitrary code execution privileges.

Impact

Successful exploitation of CVE-2026-104070 grants an unauthenticated attacker full remote code execution capabilities on the host server. This allows for total system compromise, data exfiltration, and lateral movement within the target network. Given the nature of SPIP as a CMS, this vulnerability poses a high risk to all public-facing websites utilizing the Crayons plugin in versions prior to 3.5.0.

Recommendation

1. Upgrade the Crayons plugin for SPIP to version 3.5.0 or later immediately.
2. Audit web server logs for suspicious POST requests to 'crayons_store.php' that lack the 'secu_' parameter or exhibit unconventional 'crayons' action patterns.
3. Monitor for unauthorized file creation events in directories where SPIP stores skeleton files (typically '/squelettes/').