External risk intelligence

SPIP Remote Code Execution via Job Queue Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72710

SPIP is a content management system designed to be deployed as a public-facing web application. The vulnerability resides in an action handler that is reachable through the web interface, making it a commonly exposed internet-facing service in standard deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in SPIP software that could allow an unauthorized remote attacker to execute arbitrary code on affected systems. The issue stems from how the software handles certain data, which, if manipulated, can lead to severe security compromises. Given its critical nature, confirming if your SPIP instances are impacted and ensuring they are updated is a priority.

Software vulnerability allows remote code execution.
Critical flaw in widely deployed web content system.
Confirm exposure and update affected SPIP instances.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting a request to the `editer_objet` action to inject malicious data into the job queue. This data, when later processed by the system, can lead to the execution of arbitrary PHP code on the server.

Requires valid nonce and web access.
Injects malicious data into job queue.
Leads to arbitrary PHP code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote code execution vulnerability in SPIP could allow an unauthenticated attacker to inject malicious rows into the job queue. When these jobs are processed, attacker-controlled PHP functions could be executed on the system, potentially leading to a compromise.

System data and service behavior.
Remote, unauthenticated request.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SPIP application owner and the infrastructure team are likely responsible for addressing this vulnerability. The first practical step is to identify all SPIP instances, determine their business criticality and external reachability, and locate the responsible owner for each. Remediation planning should then be prioritized based on this risk assessment.

Confirm SPIP instance ownership and exposure.
Validate reachability and business criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SPIP and how is it used?

SPIP is a PHP-based content management system (CMS) used to build and maintain websites. It provides an interface for managing articles, multimedia content, and site structure. Because it is designed to manage public-facing web pages, organizations typically deploy SPIP on servers connected to the internet to serve content directly to visitors.

What does CVE-2026-72710 mean for system security?

This vulnerability is classified as CWE-915, which involves improper control of dynamically managed objects. In this case, an attacker can manipulate parameters in the software's object editing process to inject unauthorized data into a background task queue. When the system processes these tasks, it unintentionally executes arbitrary PHP code, granting an attacker the ability to run unauthorized commands on the server.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted network request to the software's object editing action. While the process requires a valid security token (nonce), the system fails to properly verify the data being injected. Importantly, this does not require administrative credentials to initiate; however, the actual code execution occurs later, specifically when the system automatically processes and drains its background job queue.

Do I need to worry if my SPIP instance is internal?

Halo Surface Signal indicates that SPIP is frequently deployed as a public-facing web application. If your instance is internet-facing, it is directly reachable by external actors and carries a higher risk. While internal instances are less accessible, they may still be vulnerable if a threat actor gains a foothold within your network. You should verify the network accessibility of all your SPIP deployments.

How should I respond to this vulnerability?

Start by conducting an inventory to locate all SPIP instances running within your environment and identify the team responsible for each. Review the version of your software to see if it is affected, as the issue is resolved in version 4.4.18. Prioritize your response by assessing the business importance and network exposure of each system, then coordinate with your technical teams to apply the vendor-provided update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.