The Crayons plugin for SPIP — CVE-2026-104070 (Critical)

Date Oct 6, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product The · Crayons plugin for SPIP

CVE CVE-2026-104070

Critical vendor advisory CVE-2026-104070

Summary

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code executio

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in The Crayons plugin for SPIP. Patch or mitigate promptly. EPSS percentile: 45%.

Operator check

Review CVE-2026-104070 in your asset inventory. Apply patches per vendor guidance and verify Crayons plugin for SPIP is not exposed. CVSS score: 9.8. EPSS probability: 0.6%; percentile: 45%.

Sources

NVD — CVE-2026-104070 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed