CVE-2026-72708

This is a flaw that can let a stranger ask your website’s database questions it should refuse. It is like a visitor finding a way to inspect locked filing cabinets one drawer at a time, potentially exposing confidential information stored by the site.

This matters to you if your website runs SPIP. An attacker does not need an account or staff member to click anything; it is only a risk when the SPIP site can be reached from the internet.

There is no confirmed active exploitation and no public attack code on record, but the weakness can be reached remotely by an outsider. Treat this as an amber priority: arrange the update promptly, especially for public-facing SPIP sites.

Confirm the deployed SPIP version from the administration interface, application files, or your hosting provider, and confirm that the public site serves sitemap.xml.html. Upgrade using SPIP’s normal supported release process to the vendor-fixed release, then clear relevant application caches and verify normal sitemap generation and site functions.

If the upgrade must wait, restrict external access to sitemap.xml.html at the web server or reverse proxy where doing so is operationally acceptable. Review access logs for unusual or repeated requests to that path, especially requests containing abnormal annee parameter values, and investigate any evidence of database-query timing probes. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date.

CVE-2026-72708 is CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-89, SQL injection. A crafted annee value can bypass escaping for date-type database columns through the sitemap.xml.html template, enabling blind time-based or boolean-based extraction against MySQL, SQLite, or PostgreSQL. The reported impact includes extraction of arbitrary database content, potentially including the alea_ephemere secret used to sign SPIP action nonces. It is not listed in CISA KEV, no public exploit code is recorded, and EPSS is 0.3% at the 25th percentile with a flat trend; press attention is rising.