CVE-2026-22206

SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags

Summary

Original description

The description as published by the source.

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-22206 spip
Ubuntu UBUNTU-CVE-2026-22206 spip

References

advisory github.com
advisory nvd.nist.gov
advisory vulncheck.com
patch blog.spip.net
web git.spip.net

Metadata

CVE: CVE-2026-22206
Published: 2026-02-26
First seen on SecPulse: 7 months ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-89

Detection sources

OSV.dev (Open Source Vulnerabilities) 2 months ago