SPIP Crayons Plugin: Missing authorization leads to unauthenticated RCE
Summary
The Crayons plugin for SPIP before 3.5.0 lacks an authorization check that allows unauthenticated attackers to modify editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, read configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton as PHP code under the web-server user. No login is required and the attack can be carried out over the network.
Affected
- SPIP Crayons Plugin versions 0 to before 3.5.0
- Unknown whether other SPIP core or plugin branches are affected by this CVE
Fixed in
- SPIP Crayons Plugin 3.5.0 (vendor advisory of 6 October 2026)
- The vendor recommends updating Crayons together with SPIP core 4.4.27 and also lists further security fixes in this release
Workaround
- If an immediate update is not possible, remove or disable the Crayons plugin. This may break in-place editing features on the site.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- Not listed in CISA KEV; not marked as known exploited in the sources reviewed
- A public proof of concept is reported in a threat-intelligence write-up; this was not independently verified
Our recommendation
- Identify all SPIP sites with the Crayons plugin installed and check the plugin version.
- Update Crayons to version 3.5.0 immediately, together with SPIP core 4.4.27 as recommended by the vendor.
- If patching is delayed, disable the Crayons plugin.
- Review web server logs for requests to crayons_store.php and for unexpected .html or PHP files on the web server, and rotate the site secret after patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SPIP blog: critical security updates for Crayons and Simplog blog.spip.net
- SPIP plugin page: Crayons plugins.spip.net
- VulnCheck advisory: SPIP Crayons plugin authorization bypass RCE www.vulncheck.com
- OpenCVE: CVE-2026-104070 app.opencve.io
- Hacker Wire: CVE-2026-104070 Crayons plugin for SPIP www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:15.
Original description (NVD)
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.