External risk intelligence

SPIP SQLite Code Injection via Navigation Menu

CVE advisorySeverity: HIGH (CVSS 7.7)

CVE-2026-66738

SPIP is a content management system designed to be a public-facing web application. The vulnerability exists within an endpoint (/ecrire/?exec=navigation) that is part of the application's administrative interface. While access requires editor-level privileges, such web management interfaces for content management systems are commonly exposed to the internet in real-world deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects SPIP installations using SQLite, allowing an authenticated user with editor privileges to execute arbitrary operating system commands by sending a crafted request to the navigation menu endpoint. MySQL-backed installations are not impacted. The main concern is confirming relevance and exposure.

Code can be injected via the navigation menu.
Attackers can run commands on the server.
Confirm if your SQLite-based SPIP is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted web request to the navigation menu endpoint of a SQLite-backed SPIP installation. This request bypasses security checks, allowing the attacker to inject and execute arbitrary commands on the web server. The vulnerability is present in the administrative interface, requiring prior authenticated access at the editor level.

Requires editor-level access.
Exploited via crafted GET request.
Allows arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

In SQLite-backed installations of SPIP, an authenticated attacker with editor privileges could execute arbitrary operating system commands on the web server. This is possible through a crafted GET request to the navigation menu endpoint, which improperly handles array-typed user input, bypassing sanitization and allowing code injection. MySQL-backed installations are unaffected.

Arbitrary OS commands on web server.
Unsanitized array input via GET request.
Unauthorized system control possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely resides with platform or web application teams responsible for SPIP installations using SQLite. The first practical step is to identify all such installations, confirm their internet reachability and business criticality, and then engage the accountable owner for remediation planning.

Identify affected SPIP SQLite installations.
Verify internet reachability and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SPIP?

SPIP is a PHP-based content management system used to build and manage public-facing websites. It is designed to handle multilingual content and editorial workflows. This specific vulnerability affects how the software manages data when it is configured to use the SQLite database engine to store site information.

What does CWE-94 mean for CVE-2026-66738?

CWE-94 refers to Improper Control of Generation of Code. In the context of this CVE, it means the application fails to properly sanitize user-provided input before using it to construct commands. Because the system mistakenly treats parts of a navigation menu request as executable code rather than plain text, an attacker can manipulate the input to run unauthorized operating system commands on the server.

How is this code injection triggered?

An attacker with at least editor-level privileges must send a specifically crafted GET request to the navigation menu endpoint at /ecrire/?exec=navigation. The vulnerability specifically targets how array-typed inputs are handled; if your SPIP installation uses MySQL instead of SQLite, this specific attack path does not work because the underlying code handling for the menu is different.

Is my SPIP installation at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant because SPIP is typically deployed as a public-facing web application. Since the administrative interface is often accessible via the internet, any installation using SQLite is a potential target. Even though editor-level authentication is required, the public nature of these management portals increases the overall risk profile.

What should I do to respond to this threat?

First, inventory your systems to identify all SPIP installations that are configured with SQLite. Once identified, verify if these instances are reachable from the internet and assess their business importance. Prioritize these for updates and coordinate with your web application team to plan and implement the necessary patches provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.