SPIP 4.4.29 fixes multiple flaws including pre-auth XSS, SQL injection and post-auth XSS leading to RCE; CERT-FR relays advisory
CERT-FR published advisory CERTFR-2026-AVI-1465 on 5 November 2026 relaying the SPIP security bulletin of 4 November 2026, which accompanies the release of SPIP 4.4.29. All SPIP versions prior to 4.4.29 are affected, and the risks listed are remote arbitrary code execution, privilege escalation, data integrity loss and cross-site scripting. The project describes the release as a critical security update fixing several classes of flaw (blog.spip.net). No CVE identifier, CVSS score, exploit or indicator of compromise is published by CERT-FR or by the project, and no exploitation in the wild is reported at this stage. Given that SPIP is an internet-facing CMS and that at least one of the flaws is reachable before authentication, prompt patching is warranted.
Entenda a falha
A vulnerabilidade
SPIP versions before 4.4.29 contain several flaws, with no CVE assigned. The project lists privilege escalation, post-authentication arbitrary file deletion, post-authentication XSS that can lead to remote code execution, pre-authentication XSS and SQL injection. CERT-FR relays the risks as remote code execution, privilege escalation, data integrity loss and XSS. The articles give no detail on each flaw's requirements beyond the pre/post-authentication labels. All are fixed in 4.4.29, and the project warns the "écran de sécurité" does not mitigate them.
Como funciona
The articles do not describe the internal mechanism of each flaw, and the bulletin names no per-flaw commits. They only say that one XSS is reachable before authentication, that another XSS requires an authenticated user and can escalate to code execution, and that the release also fixes an ajax context cache that grew excessively and could be poisoned by attempts to exploit older flaws.
Por que é vulnerável
The articles do not state the root causes. The classes named (SQL injection, XSS, file deletion, privilege escalation) point to missing input validation or access checks, but this is not confirmed by the sources. The fix is the 4.4.29 release together with updated bundled plugins.
Como foi descoberta
According to the SPIP bulletin of 4 November 2026, the fixes were reported by 0xkidz, gaspard, Nostromo and Victor Soler Renaud of Devoteam Purple Team. CERT-FR relayed the bulletin on 5 November 2026. No exploitation in the wild is reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:31.
Detalhes técnicos
The SPIP maintenance team states that 4.4.29 fixes flaws of the following types: privilege escalation, post-authentication arbitrary file deletion, post-authentication XSS that can lead to RCE, pre-authentication XSS and SQL injection (blog.spip.net). The release also fixes a bug by which the ajax context cache grew excessively and could be poisoned through attempts to exploit older flaws. The project explicitly warns that these flaws are not mitigated by the "écran de sécurité" (security screen), so that stopgap does not protect unpatched installations. The fixes were reported by 0xkidz, gaspard, Nostromo and Victor Soler Renaud – Devoteam Purple Team (blog.spip.net).
Detalhes da correção
The corrections ship in SPIP 4.4.29 (branch 4.4, active maintenance, PHP 7.4 to 8.5), distributed as spip-v4.4.29.zip on files.spip.net, together with updated bundled plugins: ecrire 4.4.29, prive 1.1.8, bigup 3.3.15, medias 4.4.16, mots 4.3.2, porte-plume 3.1.13, revisions 3.1.15, safehtml 3.2.2, sites 4.4.8, stats 3.2.1 and svp 3.2.8, whose CHANGELOG files are published on git.spip.net. Detailed commits per flaw are not named in the bulletin (blog.spip.net).
Remediação
Upgrade to SPIP 4.4.29 or later, either from the archive on files.spip.net or with spip_loader 8.0.5 from get.spip.net. Sites using the memoization plugin must update it to version 4.1.2 before running the SPIP upgrade, otherwise the private area breaks (blog.spip.net); several administrators reported broken images and private-space errors right after the update, with workarounds discussed on discuter.spip.net. The blog page is itself generated by SPIP 4.4.30, indicating a subsequent release on the 4.4 branch that administrators should consider installing (blog.spip.net).
Linha do tempo
-
SPIP 4.4.29 fixes multiple flaws including pre-auth XSS, SQL injection and post-auth XSS leading to RCE; CERT-FR relays advisory
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1465 on 5 November 2026 relaying the SPIP security bulletin of 4 November 2026, which accompanies the release of SPIP 4.4.29. All SPIP versions prior to 4.4.29 are affected, and the risks listed are remote arbitrary code execution, privilege escalation, data integrity loss and cross-site scripting. The project describes the release as a critical security update fixing several classes of flaw (blog.spip.net). No CVE identifier, CVSS score, exploit or indicator of compromise is published by CERT-FR or by the project, and no exploitation in the wild is reported at this stage. Given that SPIP is an internet-facing CMS and that at least one of the flaws is reachable before authentication, prompt patching is warranted.
Technical Details
The SPIP maintenance team states that 4.4.29 fixes flaws of the following types: privilege escalation, post-authentication arbitrary file deletion, post-authentication XSS that can lead to RCE, pre-authentication XSS and SQL injection (blog.spip.net). The release also fixes a bug by which the ajax context cache grew excessively and could be poisoned through attempts to exploit older flaws. The project explicitly warns that these flaws are not mitigated by the "écran de sécurité" (security screen), so that stopgap does not protect unpatched installations. The fixes were reported by 0xkidz, gaspard, Nostromo and Victor Soler Renaud – Devoteam Purple Team (blog.spip.net).
Fix Details
The corrections ship in SPIP 4.4.29 (branch 4.4, active maintenance, PHP 7.4 to 8.5), distributed as spip-v4.4.29.zip on files.spip.net, together with updated bundled plugins: ecrire 4.4.29, prive 1.1.8, bigup 3.3.15, medias 4.4.16, mots 4.3.2, porte-plume 3.1.13, revisions 3.1.15, safehtml 3.2.2, sites 4.4.8, stats 3.2.1 and svp 3.2.8, whose CHANGELOG files are published on git.spip.net. Detailed commits per flaw are not named in the bulletin (blog.spip.net).
Remediation
Upgrade to SPIP 4.4.29 or later, either from the archive on files.spip.net or with spip_loader 8.0.5 from get.spip.net. Sites using the memoization plugin must update it to version 4.1.2 before running the SPIP upgrade, otherwise the private area breaks (blog.spip.net); several administrators reported broken images and private-space errors right after the update, with workarounds discussed on discuter.spip.net. The blog page is itself generated by SPIP 4.4.30, indicating a subsequent release on the 4.4 branch that administrators should consider installing (blog.spip.net).