CVE-2026-22206 - Vulnerability Analysis

Overview

SPIP < 4.4.10 contains a sql injection caused by union-based injection techniques in SQL queries, letting authenticated low-privilege users execute arbitrary SQL queries and potentially achieve remote code execution, exploit requires authentication.

Severity & Score

Impact

Authenticated low-privilege users can execute arbitrary SQL queries and potentially achieve remote code execution on the server.

Mitigation

Update to version 4.4.10 or later.

References

• https://git.spip.net/spip/spip
• https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner