Read the docs
TI-2026-85086 Aliases CVE-2026-122032GHSA-hjqm-w8hv-xfp6

SPIP SQL injection via where parameter lets authenticated users read database

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

SPIP before 4.4.29 contains an SQL injection flaw (CWE-89) in the /ecrire/?exec=articles endpoint. An authenticated attacker with back-office access can submit a where parameter in the POST body that differs from the one in the GET query string, which bypasses sanitization and lets the attacker run arbitrary SQL to extract database contents, including bcrypt password hashes of users.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip_sanitize_from_request() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed SPIP (SPIP): 4.4.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SPIPSPIPbefore 4.4.294.4.29Patch availableCNA
  • SPIP VendorSPIP Affected before 4.4.29 Fixed in 4.4.29 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*——SPIP
  • cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* Versions — — ·SPIP

Remediation

Update SPIP to version 4.4.29 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA SPIP (SPIP) Fixed in 4.4.29

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122032
  2. 2026-11-04 Alias added: GHSA-hjqm-w8hv-xfp6
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → LOW

References

Patch 1

Other 1

  • TI-2023-12107 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because… CVSS 3.1CRITICAL 9.8
  • TI-2024-07895 SPIP Bigup Multipart File Upload OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2024-07375 SPIP porte_plume Plugin Arbitrary PHP Execution CVSS 3.1CRITICAL 9.8
  • TI-2026-50946 SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-50945 SPIP < 4.4.18 Missing Authorization via ecrire/action/ CVSS 4.0CRITICAL 9.3
  • TI-2026-22104 SPIP tickets < 4.3.3 Unauthenticated RCE CVSS 4.0CRITICAL 9.3
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences