PT-2026-22182 · Spip · Spip

Arthur Deloffre + 1 · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-22206

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.10

Description SPIP versions before 4.4.10 have a SQL injection flaw. Authenticated low-privilege users can execute arbitrary SQL queries through union-based injection techniques. Attackers can combine this SQL injection with PHP tag processing to achieve remote code execution on the server.

Recommendations Update to SPIP version 4.4.10 or later.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-22206

Affected Products

Spip

References · 15

• https://osv.dev/vulnerability/CVE-2026-22206 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22206 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-22206 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-22206 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22206 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22206 · Vendor Advisory
• https://twitter.com/cracbot/status/2028787683829625268 · Twitter Post
• https://t.me/CVEtracker/45873 · Telegram Post
• https://vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags · Note
• https://git.spip.net/spip/spip · Note
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/2027466660916171104 · Twitter Post
• https://t.me/cveNotify/153772 · Telegram Post
• https://twitter.com/TheHackerWire/status/2027463045551951985 · Twitter Post