CVE-2026-22206

HighPublic PoC

Published: 26 February 2026

Published

26 February 2026

Modified

02 March 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0022 45.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22206 is a high-severity SQL Injection (CWE-89) vulnerability in Spip Spip. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the SQL injection vulnerability by requiring timely identification, reporting, and patching of flaws like those in SPIP prior to 4.4.10.

SI-10 Information Input Validation good match

prevent

Prevents union-based SQL injection attacks by enforcing validation and sanitization of all user inputs processed into SQL queries.

AC-6 Least Privilege partial match

prevent

Limits damage from low-privilege authenticated users exploiting the vulnerability by enforcing minimal permissions on application and database accounts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing SPIP CMS (T1190) allows low-privilege authenticated users to execute arbitrary SQL for data collection from databases (T1213.006) and chain to RCE for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP tag processing to achieve remote…

code execution on the server.

Deeper analysisAI

SPIP versions prior to 4.4.10 are affected by CVE-2026-22206, a SQL injection vulnerability (CWE-89) that enables authenticated low-privilege users to execute arbitrary SQL queries through union-based injection techniques. This flaw, published on 2026-02-26, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability arises in the context of SPIP, an open-source content management system, and can be chained with PHP tag processing to escalate to remote code execution on the server.

Low-privilege authenticated users, such as contributors or authors with minimal permissions, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows attackers to execute arbitrary SQL queries, potentially extracting sensitive data, modifying database contents, or achieving full remote code execution by leveraging PHP tag processing mechanisms.

Advisories recommend updating to SPIP 4.4.10, as detailed in the official SPIP security blog post announcing the release. The SPIP Git repository provides the patched source code, while the VulnCheck advisory elaborates on the SQL injection leading to RCE via union-based techniques and PHP tags.