CVE catalog

CVE-2026-66738

DEBIAN-CVE-2026-66738

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.58% · Oct 25, 2026

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET request to /ecrire/?exec=navigation to execute arbitrary OS commands in the web server process. MySQL-backed installations are not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspip134.4.10+dfsg-1vulnerable
Debianspip134.4.11+dfsg-0+deb13u1vulnerable
Debianspip134.4.11+dfsg-1vulnerable
Debianspip134.4.13+dfsg-0+deb13u1vulnerable
Debianspip134.4.13+dfsg-1vulnerable
Debianspip134.4.14+dfsg-1vulnerable
Debianspip134.4.15+dfsg-0+deb13u1vulnerable
Debianspip134.4.15+dfsg-1vulnerable
Debianspip134.4.16+dfsg-0+deb13u1vulnerable
Debianspip134.4.16+dfsg-1vulnerable
Debianspip134.4.18+dfsg-1vulnerable
Debianspip134.4.3+dfsg-1vulnerable
Debianspip134.4.3+dfsg-1+deb13u1vulnerable
Debianspip134.4.4+dfsg-1vulnerable
Debianspip134.4.5+dfsg-1vulnerable
Debianspip134.4.6+dfsg-1vulnerable
Debianspip134.4.7+dfsg-1vulnerable
Debianspip134.4.8+dfsg-1vulnerable
Debianspip134.4.9+dfsg-1vulnerable
Debianspip134.4.19+dfsg-0+deb13u1fixed
Debianspip144.4.10+dfsg-1vulnerable
Debianspip144.4.11+dfsg-1vulnerable
Debianspip144.4.13+dfsg-1vulnerable
Debianspip144.4.14+dfsg-1vulnerable
Debianspip144.4.15+dfsg-1vulnerable
Debianspip144.4.16+dfsg-1vulnerable
Debianspip144.4.3+dfsg-1vulnerable
Debianspip144.4.4+dfsg-1vulnerable
Debianspip144.4.5+dfsg-1vulnerable
Debianspip144.4.6+dfsg-1vulnerable
Debianspip144.4.7+dfsg-1vulnerable
Debianspip144.4.8+dfsg-1vulnerable
Debianspip144.4.9+dfsg-1vulnerable
Debianspip144.4.18+dfsg-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspipdeb134.4.19+dfsg-0+deb13u1Not reportedDEBIAN-CVE-2026-66738Not reported
Debianspipdeb144.4.18+dfsg-1Not reportedDEBIAN-CVE-2026-66738Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [spip]Affected
    Details (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Affected · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Affected · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Affected · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 4.4.19+dfsg-0+deb13u1

      pypi · spip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]