---
id: CVE-2026-122032
title: SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
summary: >-
  SPIP before 4.4.29 contains a SQL injection vulnerability that allows
  authenticated attackers with back-office access to inject arbitrary SQL by
  submitting a differing where parameter value in the POST body versus the GET
  query string on…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: SPIP
product: SPIP
affected:
  - SPIP < 4.4.29
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:43:12.336846Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:43:24.011Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122032'
references:
  - url: 'https://www.spip.net/fr_article6500.html'
    label: Vendor Patch
  - url: >-
      https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-29.html
    label: Vendor Blog
  - url: >-
      https://www.vulncheck.com/advisories/spip-before-authenticated-sql-injection-via-where-parameter
    label: >-
      VulnCheck Advisory: SPIP before 4.4.29 Authenticated SQL Injection via
      where Parameter
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.494Z'
---

## Overview

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip_sanitize_from_request() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users.

## Affected

- `SPIP < 4.4.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.