CVE-2026-66738: Critical SPIP Code Injection (CVSS 9.8) — Detection and Remediation Guide

On February 11, 2026, NVD published CVE-2026-66738, a CVSS 9.8 (Critical) code injection vulnerability in SPIP — one of the most widely deployed open-source content management systems in the Francophone world, powering thousands of government, media, education, and nonprofit sites across Europe, Africa, and Canada. All SPIP versions prior to 4.4.18 are affected, but only when backed by SQLite. An attacker holding as little as an editor (redacteur) account — the lowest privileged editorial role in SPIP — can send a single crafted GET request to /ecrire/?exec=navigation and execute arbitrary operating system commands inside the web server process.

One note on the circulating coverage: some aggregators are indexing this CVE under "mysql." That is misleading. The NVD record is explicit — MySQL-backed SPIP installations are NOT affected. The vulnerable code path exists only in the SQLite database layer. If you run SPIP on MySQL or PostgreSQL, this specific vulnerability does not apply to you, though you should still patch as part of normal hygiene.

This is a classic low-privilege-to-RCE escalation path. Editor accounts are handed out liberally in CMS environments — to contractors, interns, content contributors — and they are among the most commonly phished credentials. CVSS 9.8 with network attack vector, low complexity, and no user interaction required means defenders should treat this as a patch-this-week priority.

Technical Analysis

Affected Products and Versions

How the Vulnerability Works

The flaw lives in SPIP's navigation menu administrative endpoint, reachable at:

/ecrire/?exec=navigation

The endpoint accepts a parameter that it expects to be a scalar string. When an attacker submits the parameter as a PHP array (e.g., param[]=value instead of param=value), the value flows through a code path in SQLite-backed installations that bypasses SPIP's input sanitization. The attacker-controlled array element is then evaluated in a PHP context where it can break out of an internal quoted string — the classic eval-style injection pattern — resulting in arbitrary PHP code execution. Because SPIP runs inside the web server process, that PHP execution translates directly to OS command execution as the web server user (typically www-data on Debian/Ubuntu, apache on RHEL-family systems).

The attack chain from a defender's perspective:

1. Credential acquisition — attacker phishes, brute-forces, or purchases a redacteur-level account (or registers one if self-registration is enabled).
2. Single crafted GET request to /ecrire/?exec=navigation with an array-typed parameter carrying the injection payload.
3. PHP code execution in the web server context — typically followed by spawning a shell (/bin/sh, bash), downloading a webshell or reverse shell, and post-exploitation (credential dumping, lateral movement, cryptomining, or staging for ransomware).

The post-exploitation behavior is your highest-fidelity detection opportunity: a PHP-FPM, Apache, or nginx worker process spawning a system shell or command interpreter is anomalous in virtually every SPIP deployment.

Exploitation Status

As of this writing, CVE-2026-66738 has not been added to the CISA Known Exploited Vulnerabilities catalog, and no public in-the-wild exploitation campaign has been formally attributed to it. However, the vulnerability has three properties that historically correlate with rapid weaponization:

• Trivial exploit mechanics — a single GET request, no race conditions, no memory corruption.
• Low privilege bar — editor accounts are abundant and weakly protected.
• A clearly documented patch — the diff between vulnerable versions and 4.4.18 gives researchers and attackers alike a precise map to the vulnerable code path.

Treat exploitation as imminent, not theoretical. Assume any internet-facing SPIP instance on SQLite that remained unpatched after public disclosure is a target.

Detection & Response

The detection strategy has three layers: (1) web access log analysis for the exploitation request itself, (2) process execution monitoring for post-exploitation command spawning from the web server process, and (3) file integrity hunting for dropped webshells in SPIP-writable directories.

Sigma Rules

These rules target the two most reliable observable behaviors: the crafted request pattern in web server logs, and the web server process spawning shells or command interpreters post-exploitation.

---
title: SPIP CVE-2026-66738 Navigation Endpoint Exploitation Attempt
id: 8f2c1a47-3b6e-4d92-a15c-9e7f0d4b8a21
status: experimental
description: Detects crafted GET requests to the SPIP navigation admin endpoint containing array-typed parameters, consistent with CVE-2026-66738 exploitation. Requires web server access logs (Apache/nginx) ingested via a Sigma-compatible pipeline with the webserver logsource.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-66738
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/ecrire/'
  selection_query:
    cs-uri-query|contains:
      - 'exec=navigation'
  selection_array:
    cs-uri-query|contains:
      - '%5B%5D='
      - '[]='
  condition: selection_uri and selection_query and selection_array
falsepositives:
  - Rare legitimate SPIP admin UI interactions that submit array-typed form fields to the navigation endpoint; verify against source IP and authenticated session user
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter
id: 3d9b5e12-7c4a-4f81-b206-5a1e8c3f7d94
status: experimental
description: Detects a PHP-FPM, Apache, or nginx worker process spawning a shell or common post-exploitation command, consistent with OS command execution achieved via web application code injection such as CVE-2026-66738 in SPIP.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-66738
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
      - '/id'
      - '/whoami'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate CMS plugins that shell out for image processing (ImageMagick) or PDF rendering — review CommandLine context and SPIP plugin inventory
level: critical

KQL (Microsoft Sentinel / Defender)

This query hunts for the exploitation request pattern in web/proxy logs ingested into Sentinel (via CommonSecurityLog from WAFs, reverse proxies, or syslog-forwarded Apache/nginx logs), then pivots to post-exploitation process execution on the web host via Syslog.

// Hunt 1: Exploitation requests against the SPIP navigation endpoint
// Covers WAF/proxy logs (CommonSecurityLog) and syslog-forwarded web logs
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(30d)
    | where RequestURL has "/ecrire/" and RequestURL has "exec=navigation"
    | where RequestURL has "[]=" or RequestURL has "%5B%5D="
    | extend Source = "CommonSecurityLog"
    | project TimeGenerated, Source, SourceIP, DestinationHostName, RequestURL,
              RequestMethod, HttpUserAgent, DeviceAction),
    (Syslog
    | where TimeGenerated > ago(30d)
    | where SyslogMessage has "/ecrire/" and SyslogMessage has "exec=navigation"
    | where SyslogMessage has "[]=" or SyslogMessage has "%5B%5D="
    | extend Source = "Syslog"
    | project TimeGenerated, Source, HostName, ProcessName, SyslogMessage)
| order by TimeGenerated desc
;
// Hunt 2: Post-exploitation — web server user spawning shells or LOLBins on the host
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc -", "base64 -d")
| where SyslogMessage has_any ("www-data", "apache", "nginx", "php-fpm")
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts the web host for the highest-value forensic indicators: suspicious process execution lineage from the web server user, and recently created or modified PHP files in SPIP-writable upload/cache directories — the standard landing zones for webshells dropped after code injection.

-- CVE-2026-66738 post-exploitation hunt: SPIP webshell artifacts and web-user process anomalies
-- Part 1: Suspicious processes running as the web server user
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ '(www-data|apache|nginx)'
  AND (CommandLine =~ '(/bin/(sh|bash|dash)|curl |wget |nc |ncat |python|perl|base64)'
       OR Name =~ '^(sh|bash|dash|nc|ncat|curl|wget)$')

-- Part 2: Recently modified PHP files in SPIP-writable directories (potential webshells)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/www/**/IMG/**/*.php',
  '/var/www/**/tmp/**/*.php',
  '/var/www/**/local/**/*.php',
  '/srv/www/**/IMG/**/*.php',
  '/srv/www/**/tmp/**/*.php'
])
WHERE Mtime > (now() - 1209600)  -- modified within the last 14 days
ORDER BY Mtime DESC

Remediation & Verification Script

The following Bash script verifies your SPIP version, identifies the database backend (the critical scoping question for this CVE), checks the web server user context, and scans access logs for exploitation indicators. Run it on every SPIP host.

#!/bin/bash
# CVE-2026-66738 SPIP verification and triage script
# Run on each SPIP web host. No destructive actions — detection and verification only.

echo "=== CVE-2026-66738 SPIP Triage ==="

# 1. Identify SPIP installations and versions
# Adjust the document root path for your environment
echo "[+] Locating SPIP installations..."
SPIP_DIRS=$(find /var/www /srv/www /home -maxdepth 4 -name "ecrire" -type d 2>/dev/null)
for d in $SPIP_DIRS; do
  SITE_ROOT=$(dirname "$d")
  echo "[+] Found SPIP at: $SITE_ROOT"
  # Version is defined in ecrire/inc_version.php
  if [ -f "$d/inc_version.php" ]; then
    grep -E "spip_version(_affichee)?" "$d/inc_version.php" | head -3
  fi

  # 2. Determine DB backend — SQLite is the affected configuration
  echo "[+] Checking database backend..."
  if [ -f "$d/config/connect.php" ]; then
    grep -iE "sqlite|mysql|pgsql" "$d/config/connect.php" | head -3
    if grep -qi "sqlite" "$d/config/connect.php"; then
      echo "[!] WARNING: SQLite backend detected — this host IS in scope for CVE-2026-66738"
    else
      echo "[-] Non-SQLite backend — not affected by CVE-2026-66738 (patch anyway)"
    fi
  fi
done

# 3. Hunt access logs for exploitation attempts (crafted navigation requests)
echo "[+] Scanning web access logs for exploitation indicators..."
for log in /var/log/apache2/access.log* /var/log/nginx/access.log* /var/log/httpd/access_log*; do
  [ -e "$log" ] || continue
  case "$log" in
    *.gz) ZCAT="zcat" ;; *) ZCAT="cat" ;;
  esac
  HITS=$($ZCAT "$log" 2>/dev/null | grep "exec=navigation" | grep -E "(%5B%5D=|\[\]=)" | head -20)
  if [ -n "$HITS" ]; then
    echo "[!] SUSPICIOUS REQUESTS in $log:"
    echo "$HITS"
  fi
done

# 4. Check for recently modified PHP files in SPIP-writable directories (webshell triage)
echo "[+] Checking for recently modified PHP files in upload/cache dirs (last 14 days)..."
for d in $SPIP_DIRS; do
  SITE_ROOT=$(dirname "$d")
  find "$SITE_ROOT/IMG" "$SITE_ROOT/tmp" "$SITE_ROOT/local" -name "*.php" -mtime -14 2>/dev/null
done

# 5. List processes currently running as the web server user that shouldn't be
echo "[+] Checking for anomalous processes under web server user..."
ps -eo user,pid,ppid,comm,args | grep -E "^(www-data|apache|nginx)" | grep -E "(sh|bash|dash|nc|curl|wget|python|perl)" | grep -v grep

echo "=== Triage complete. If ANY [!] findings appeared, isolate the host and initiate IR. ==="

Remediation

1. Patch immediately. Upgrade SPIP to version 4.4.18 or later. This is the only complete fix. Use SPIP's built-in updater (spip_loader) or your standard package/deployment pipeline. Verify the version in ecrire/inc_version.php after upgrade.

2. Scope your exposure first. Only SQLite-backed installations are vulnerable to CVE-2026-66738. Check ecrire/config/connect.php on every SPIP host. Prioritize internet-facing SQLite instances; MySQL/PostgreSQL-backed sites should patch on the normal cycle.

3. If you cannot patch today, apply compensating controls:

• Restrict /ecrire/ at the edge. Limit access to the SPIP admin interface to known corporate/VPN IP ranges via nginx allow/deny, Apache Require ip, or your WAF/reverse proxy. This breaks the attack chain even for an attacker holding valid credentials, unless they are already inside your perimeter.
• Deploy a WAF rule blocking requests to exec=navigation that contain array-typed parameters ([]= or %5B%5D= in the query string).
• Disable PHP execution in writable directories (IMG/, tmp/, local/) via web server configuration — this neuters most webshell drops even if code execution is achieved.

4. Audit editor accounts. The exploit requires only redacteur privileges. Enumerate all SPIP accounts with editor-or-higher roles, disable dormant accounts, enforce strong passwords and MFA where your SPIP deployment supports it, and review account creation logs for unauthorized registrations.

5. Hunt before you patch. Because exploitation requires only a single logged GET request, run the log-hunting portion of the script above before upgrading. If you find hits, preserve logs and the host — you may have an active compromise that a patch will not remediate. A patched server with a pre-existing webshell is still a compromised server.

6. Post-patch verification. Confirm the site responds normally, verify the version string, and continue monitoring for web-user process anomalies for at least 14 days post-patch.

The Bigger Lesson

CVE-2026-66738 is a textbook example of why "authenticated" does not mean "low risk." The lowest editorial role in a CMS is often the least protected identity in the organization — shared credentials, no MFA, minimal monitoring. When a low-privilege authenticated path collapses directly into OS command execution, your entire defense rests on whether anyone notices a www-data shell. Type-juggling bugs (array-where-scalar-expected) are a recurring PHP vulnerability class; if your WAF and log pipelines aren't tuned to flag type-confusion request patterns, this CVE is your cue to build that capability now.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub