---
id: CVE-2026-66738
title: >-
  SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed
  installations
summary: >-
  SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed
  installations. The navigation menu endpoint improperly handles array-typed
  user input, which bypasses input sanitization and allows the value to break
  out of an …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
published: '2026-08-10'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:35:08.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66738'
references:
  - url: >-
      https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/spip-code-injection-via-navigation-endpoint-on-sqlite
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00583
epssPercentile: 0.45541
ingestedAt: '2026-09-09T21:22:45.526Z'
---

## Overview

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.