CVE-2026-72710

COMPONENT VERSION RANGE

NewScan fingerprints SPIP from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-12. CVSS 9.3 (v4) / 9.8 (v3.1). The editer_objet action resolves the SQL table named by `arg` without an editable-columns allowlist, so `arg=job/0` writes an attacker-controlled row into spip_jobs; its `fonction` and `args` are unserialized and called when the cron queue drains, which is arbitrary PHP execution on the host. Link 3 of the Lexfo chain and the reason the other two matter - it needs only `a valid nonce`, which CVE-2026-72709's missing autoriser() check hands to an unauthenticated caller. Note the deferred trigger: execution happens when cron next runs, NOT in the attacker's request, so nothing about this is provable by response-time or by an in-band echo. Same `ge 4.4.0` bound and same three-row rationale as the CVE-2026-72709 row above. Version-match only. Reachable through the SPIP tech_signatures rows via GET /CHANGELOG.md; what was re-measured live on 2026-09-12 is the version read - a running ipeos/spip served `## 4.4.21 - 2026-08-20` and fingerprinted as SPIP 4.4.21 with no findings - which puts the container above this row's `lt 4.4.18`, i.e. on the patched side. Both sides of 4.4.18 are pinned as fixtures in tests/integration/tech_version_from_checks.py.