CVE-2026-27475
Last modified
CVE-2026-27475 is a critical-severity vulnerability rated 9.2/10 on the CVSS scale. SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Spip | Spip | >= 4.4.0, < 4.4.9 |
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.htmlRelease Notes, Vendor Advisory
- https://www.vulncheck.com/advisories/spip-insecure-deserializationThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27475?
How severe is CVE-2026-27475?
How do I fix CVE-2026-27475?
Are you affected by CVE-2026-27475?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST