CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
Authenticated attackers can execute arbitrary OS commands via code injection in SQLite-backed SPIP installations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66738?
CVE-2026-66738 is a high-severity code injection vulnerability in SPIP, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.
Weakness: CWE-94
Which versions are affected by CVE-2026-66738?
How do I fix CVE-2026-66738?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-66738 being exploited?
There is no known exploitation of CVE-2026-66738 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-66738, GHSA-ghch-c3xx-8rq5, UBUNTU-CVE-2026-66738.