Vulnerability · Published Oct 6, 2026 · Assigned by VulnCheck

CVE-2026-104070SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

Critical 9.8

In plain English

A critical-severity missing authorization in SPIP Crayons Plugin from SPIP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 52.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.

Affected products (as reported)

Vendor	Product	Versions
SPIP	SPIP Crayons Plugin	0 – before 3.5.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

SPIP Advisory vendor-advisory, patch
Download Page product
https://www.vulncheck.com/advisories/spip-crayons-plugin-authorization-bypass-rce third-party-advisory