CVE-2026-66738 is a high severity (CVSS 8.8 in the record) code injection in SPIP before 4.4.18. It affects SQLite backed installations, and an account with editor privileges or higher can trigger it. SPIP fixed it in 4.4.18. Upgrade, then run the database update from the private area.
What's affected
SPIP before 4.4.18, when the site uses SQLite as its database. VulnCheck's advisory says MySQL backed installations are not affected. The fixed version is 4.4.18, released on 10 August 2026.
Severity differs by source. The record gives CVSS 8.8 (High). VulnCheck lists 7.7 using a CVSS v4 vector, also in the High band. The SPIP release announcement calls 4.4.18 a critical security update and lists several fixes together, including SQL injections, a remote code execution through a job queue after SQL injection, and a code injection in the private area. It does not map each fix to a CVE number, so I cannot say which line item is this one beyond VulnCheck's description.
The weakness is CWE-94. VulnCheck says the navigation menu endpoint mishandles array typed user input, which bypasses sanitization and lets a value break out of an internal quoted string when it is evaluated as PHP. An authenticated user with at least editor (redacteur) privileges can send a single crafted request to the private area's navigation page and run operating system commands as the web server process.
How to check if you're exposed
Read the SPIP version in the private area of your site, and check which database it uses. Your site's connection file in the config folder names the database server type. Sites on SQLite are in scope below 4.4.18.
Also count the accounts with editor rights or higher. The attacker needs one. Sites with open registration, many contributors or reused passwords carry more risk than a site with a handful of trusted staff.
What to do now
- Back up the site's files and database.
- Upgrade to SPIP 4.4.18, using the private area or the latest spip_loader as the release notes describe.
- Run the database update after the upgrade, as the release notes say. Do it through the private area if you did not use spip_loader.
- Review accounts with editor rights and remove those that are not needed.
- Check web server logs and the site's files for changes you did not make. The release notes say the security screen does not cover these flaws.
Why it matters
Code injection happens when user input is placed inside code that is then evaluated. Here the input is meant to be a string, and an array typed value slips past the checks that protect strings, so the value can end the quoted text and add code of its own.
The result runs as the web server process, which usually has access to the site's files and database. The authentication requirement lowers the risk but does not remove it, since editor accounts are common on content sites. The upgrade also closes several other issues listed in the release notes, which is a good reason not to wait.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it affect MySQL sites?
VulnCheck says MySQL backed installations are not affected. Upgrade anyway, because 4.4.18 fixes other security issues.
Does the security screen block it?
The SPIP announcement says the flaws fixed in 4.4.18 are not handled by the security screen, so you need the upgrade.
Sources
- SPIP blog: critical security update, release of SPIP 4.4.18
- VulnCheck advisory for SPIP code injection via the navigation endpoint on SQLite
Last reviewed: 18 October 2026.
