CVE-2026-122032 · Package
NO FIX YET · SEE WHAT TO DO
SPIP, a PHP content management system, has a SQL injection flaw in its article admin page where a mismatched parameter between POST and GET bypasses input sanitization. An attacker with back-office access can read database contents, including protected articles and users' bcrypt password hashes.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running SPIP before 4.4.29 where someone has back-office editor access. The flaw is reached through the /ecrire/?exec=articles admin endpoint, so public visitors without a back-office account cannot trigger it directly. Sites that restrict back-office accounts to trusted staff have a smaller window, but password hashes and protected content are still exposed to any account holder.
Not affected if no-back-office-accounts, spip-4.4.29-or-later
Who cares cms, php, self-hosted, spip
4.4.29.4.4.29 or later.SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip_sanitize_from_request() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users.
This page as .md · .json · in your agent: get_signal("CVE-2026-122032") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.