CVE-2026-72708

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

No known exploitation. EPSS puts it in the 42nd percentile. No fix published yet.

CVSS 3.17.5High EPSS percentile42nd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-11Updated 2026-09-15Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your website runs SPIP and confirm its installed version.
If it is earlier than 4.4.18, schedule an upgrade to SPIP 4.4.18.
Until the upgrade is complete, have your web host restrict public requests to sitemap.xml.html if this does not disrupt your site.
After updating, ask IT to review web-server logs for unusual requests to sitemap.xml.html.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.

In plain language

Written by AI from the record

SPIP versions before 4.4.18 let an outsider read sensitive database information without signing in, so affected businesses should update soon.

Unauthenticated blind SQL injection in SPIP’s date-column escaping can be triggered through the always-present sitemap.xml.html template’s crafted annee parameter.

If you're affected

Sensitive database data exposure
Secret key disclosure
Possible account-action forgery
Privacy incident risk

What is it

This is a flaw that can let a stranger ask your website’s database questions it should refuse. It is like a visitor finding a way to inspect locked filing cabinets one drawer at a time, potentially exposing confidential information stored by the site.

Who is affected

This matters to you if your website runs SPIP. An attacker does not need an account or staff member to click anything; it is only a risk when the SPIP site can be reached from the internet.

How urgent is it

There is no confirmed active exploitation and no public attack code on record, but the weakness can be reached remotely by an outsider. Treat this as an amber priority: arrange the update promptly, especially for public-facing SPIP sites.

What to do — in detail

Confirm the deployed SPIP version from the administration interface, application files, or your hosting provider, and confirm that the public site serves sitemap.xml.html. Upgrade using SPIP’s normal supported release process to the vendor-fixed release, then clear relevant application caches and verify normal sitemap generation and site functions.

If the upgrade must wait, restrict external access to sitemap.xml.html at the web server or reverse proxy where doing so is operationally acceptable. Review access logs for unusual or repeated requests to that path, especially requests containing abnormal annee parameter values, and investigate any evidence of database-query timing probes. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date.

Technical context

CVE-2026-72708 is CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-89, SQL injection. A crafted annee value can bypass escaping for date-type database columns through the sitemap.xml.html template, enabling blind time-based or boolean-based extraction against MySQL, SQLite, or PostgreSQL. The reported impact includes extraction of arbitrary database content, potentially including the alea_ephemere secret used to sign SPIP action nonces. It is not listed in CISA KEV, no public exploit code is recorded, and EPSS is 0.3% at the 25th percentile with a flat trend; press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS42nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 42nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 7 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-09-15Record updatedrecord updated
2026-09-11Publishedweakness classified, att&ck mapped, record updated

Affected products

SPIPoss-project · FR
- SPIPWeb AppOn-premWeb & CMS Plugins / cms-core

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact