CVE Alert: CVE-2026-72708 – SPIP

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spip_mysql_cite() in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word character followed by an open parenthesis. Attackers can supply a crafted value such as a time-based payload through the annee parameter in squelettes-dist/sitemap.xml.html to embed arbitrary SQL directly into the generated query, enabling time-based and boolean-based blind SQL injection that can expose arbitrary database content including the alea_ephemere secret used to sign action nonces.

## AI Summary Analysis

**Risk verdict:** Treat as urgent for internet-facing deployments because exploitation requires no authentication or user action and can be automated, although KEV, SSVC and EPSS status were not supplied.

**Why this matters:** Successful exploitation can disclose sensitive application data and security material, enabling follow-on abuse of authenticated workflows or administrative functions. The immediate risk is confidentiality loss, with potential escalation if exposed secrets are reused elsewhere or support further application compromise.

**Most likely attack path:** An attacker sends crafted requests over the network to the public sitemap endpoint, with low attack complexity and no privileges or interaction required (AV:N, AC:L, PR:N, UI:N). Scope is unchanged, so the direct impact remains within the application, but recovered credentials, tokens or signing material could enable lateral movement into related services.

**Who is most exposed:** Internet-accessible sites using the affected CMS, particularly public-sector, media, membership and campaign websites with legacy extensions or shared hosting. Sites exposing the default sitemap route without a reverse proxy or effective request filtering warrant immediate review.

web and proxy logs for unusual `annee` values or repeated sitemap requests.

Alert on abnormally slow, repeated or timing-correlated responses from sitemap URLs.

Review database logs for unexpected conditional delays or malformed date predicates.

Check for subsequent administrative actions, nonce failures or suspicious account activity.

Mitigation and prioritisation:

Apply the vendor security update as soon as practicable; prioritise public-facing instances first.

Temporarily restrict or disable the sitemap route where operationally acceptable.

Add WAF rules for anomalous parameter syntax, while treating this only as a compensating control.

Rotate exposed application secrets and investigate database access after patching.

Use change windows for validation, including sitemap generation, caching and extensions.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.