CVE-2026-72708

COMPONENT VERSION RANGE

NewScan fingerprints SPIP from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-12. CVSS 8.7 (v4) / 7.5 (v3.1). spip_mysql_cite() in ecrire/req/mysql.php returns the value UNESCAPED when the target column is a date type and the value matches `word character followed by an open parenthesis`, so the `annee` parameter of squelettes-dist/sitemap.xml.html concatenates straight into the query - unauthenticated, on a public endpoint. Link 1 of the Lexfo chain: what it reads out is the alea_ephemere secret SPIP signs action nonces with, which is what makes CVE-2026-72709 reachable. Scored `high` rather than `critical` on its own (confidentiality only, no integrity impact in the v3.1 vector) even though the chain it opens ends in RCE - the row states what THIS bug does and the note names the chain, because inflating a single link's severity to the chain's is how a severity standard stops meaning anything. Lexfo's PoC is time-based, and `docs/backlog.md` P1/the no-timing rule means we would not probe it that way even if it were in scope - this is a version match, not an injection probe. Same `ge 4.4.0` bound and same three-row rationale as the two rows above. Reachable through the SPIP tech_signatures rows via GET /CHANGELOG.md; what was re-measured live on 2026-09-12 is the version read - a running ipeos/spip served `## 4.4.21 - 2026-08-20` and fingerprinted as SPIP 4.4.21 with no findings - which puts the container above this row's `lt 4.4.18`, i.e. on the patched side. Both sides of 4.4.18 are pinned as fixtures in tests/integration/tech_version_from_checks.py.