CVE-2026-22206
published 2026-02-26CVE-2026-22206: SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.64%
50.0th percentile
SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | spip | < spip 4.4.10+dfsg-1 (forky) | spip 4.4.10+dfsg-1 (forky) |
| spip | spip | < 4.4.10 | 4.4.10 |
| spip | spip | >= 0 < 4.4.11+dfsg-0+deb13u1 | 4.4.11+dfsg-0+deb13u1 |
| spip | spip | >= 0 < 4.4.10+dfsg-1 | 4.4.10+dfsg-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Target application is SPIP versions prior to 4.4.10; look for authenticated low-privilege users submitting requests containing union-based SQL injection payloads to SPIP endpoints. ↗
- →Monitor for exploitation chains combining SQL injection with PHP tag processing, which may indicate an attempt to achieve remote code execution on the SPIP server. ↗
- ·The vulnerability requires authentication as a low-privilege user; unauthenticated exploitation is not described. Scope is noted as local in the Debian tracker. ↗
- ·Debian bullseye remains unpatched (open); forky and sid are fixed in 4.4.10+dfsg-1; trixie is fixed in 4.4.11+dfsg-0+deb13u1. Prioritize patching accordingly. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.7HIGH
vendor_debian8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2026-22206: spip - SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows ...
vendor_debian·2026·CVSS 8.7
CVE-2026-22206 [HIGH] CVE-2026-22206: spip - SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows ...
SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.
Scope: local
bullseye: open
forky: resolved (fixed in 4.4.10+dfsg-1)
sid: resolved (fixed in 4.4.10+dfsg-1)
trixie: resolved (fixed in 4.4.11+dfsg-0+deb13u1)
OSV
CVE-2026-22206: SPIP versions prior to 4
osv·2026-02-26·CVSS 8.7
CVE-2026-22206 [HIGH] CVE-2026-22206: SPIP versions prior to 4
SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.
GHSA
GHSA-48x6-97gc-jx62: SPIP versions prior to 4
ghsa_unreviewed·2026-02-26
CVE-2026-22206 [HIGH] CWE-89 GHSA-48x6-97gc-jx62: SPIP versions prior to 4
SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-22206 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-22206 [HIGH] CVE-2026-22206 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-22206 :
Linux Debian vulnerability analysis and mitigation
SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote code execution on the server.
Source : NVD
## 8.7
Score
Published February 26, 2026
Severity HIGH
CNA Score 8.7
Affected Technologies
Linux Debian
Echo
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 44.4
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
spip
Sources
NVD
Debian 11 Severity HIGH No Fix A
Bugzilla
CVE-2026-12704 Grafana Enterprise: Grafana Enterprise: SAML assertion replay via skipped InResponseTo validation
bugzilla·2026-08-24·CVSS 6.8
CVE-2026-12704 [MEDIUM] CVE-2026-12704 Grafana Enterprise: Grafana Enterprise: SAML assertion replay via skipped InResponseTo validation
CVE-2026-12704 Grafana Enterprise: Grafana Enterprise: SAML assertion replay via skipped InResponseTo validation
Reported by Grafana Labs via private security advisory (Jira PSIRTSUPT-22206), received 2026-08-20. CVSS 6.8 (Medium) per upstream.
Affected products and versions: Grafana Enterprise, all supported versions up to and including 11.6.17, 12.2.11, 12.3.10, 12.4.8, 13.0.6, 13.1.3. Grafana OSS is not affected (SAML SSO is an Enterprise/Cloud feature). On-premise and Grafana Cloud (Cloud already patched).
Fixed in Grafana's private security releases: 12.3.11+security-01, 12.4.9+security-01, 13.0.7+security-01, 13.1.4+security-01, 13.2.0+security-01. Public fix expected at least 14 calendar days after 2026-08-20 per upstream embargo terms.
Bugzilla
CVE-2026-14199 grafana: Grafana: Session takeover via Auth Proxy cache key collision
bugzilla·2026-08-24·CVSS 7.1
CVE-2026-14199 [HIGH] CVE-2026-14199 grafana: Grafana: Session takeover via Auth Proxy cache key collision
CVE-2026-14199 grafana: Grafana: Session takeover via Auth Proxy cache key collision
Reported by Grafana Labs via private security advisory (Jira PSIRTSUPT-22206), received 2026-08-20. CVSS 7.1 (High) per upstream.
Affected products and versions: Grafana OSS and Grafana Enterprise, all supported versions up to and including 11.6.16, 12.4.5, 13.1.0 (OnPrem). On-premise only; Grafana Cloud is not affected (Cloud does not use Auth Proxy header authentication).
Fixed in Grafana's private security releases: 12.3.11+security-01, 12.4.9+security-01, 13.0.7+security-01, 13.1.4+security-01, 13.2.0+security-01. Public fix expected at least 14 calendar days after 2026-08-20 per upstream embargo terms.
Bugzilla
CVE-2026-19475 grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
bugzilla·2026-08-24·CVSS 6.5
CVE-2026-19475 [MEDIUM] CVE-2026-19475 grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
CVE-2026-19475 grafana: Grafana: SQL Data Source Plugin: OOM DoS via $__timeGroup macro
Reported by Grafana Labs via private security advisory (Jira PSIRTSUPT-22206), received 2026-08-20. CVSS 6.5 (Medium) per upstream.
Affected products and versions: Grafana OSS and Grafana Enterprise, all supported versions up to and including 11.6.16, 12.0.10, 12.1.10+security-01, 12.2.10, 12.3.10, 12.4.8, 13.0.6, 13.1.3 (13.2.0 already contains the fix). Datasource plugins: Microsoft SQL Server 13.0.0-13.0.1, PostgreSQL 13.0.0-13.0.1, MySQL 13.0.0-13.0.2. On-premise and Grafana Cloud (Cloud already patched).
Fixed in Grafana's private security releases: 12.3.11+security-01, 12.4.9+security-01, 13.0.7+security-01, 13.1.4+security-01, 13.2.0+security-01. Public fix expected at least 14 calendar days a
2026-02-26
Published