CVE-2026-27744

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.

• CWE-94

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlRelease Notes
• https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/Third Party Advisory
• https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7Patch
• https://plugins.spip.net/ticketsProduct
• https://www.vulncheck.com/advisories/spip-tickets-unauthenticated-rceThird Party Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27739The Angular SSR is a server-rise rendering tool for Angular …9.2
• CVE-2026-2774Integer overflow in the Audio/Video component. This vulnerab…9.8
• CVE-2026-27740Discourse is an open-source discussion platform. Versions pr…6.1
• CVE-2026-27741Bludit version 3.16.1 contains a cross-site request forgery …4.3
• CVE-2026-27742Bludit version 3.16.2 contains a stored cross-site scripting…5.4
• CVE-2026-27743The SPIP referer_spam plugin versions prior to 1.3.0 contain…9.8
• CVE-2026-27745The SPIP interface_traduction_objets plugin versions prior t…8.8
• CVE-2026-27746The SPIP jeux plugin versions prior to 4.1.1 contain a refle…6.1
• CVE-2026-27747The SPIP interface_traduction_objets plugin versions prior t…8.8
• CVE-2026-27748Avira Internet Security contains an improper link resolution…7.1
• CVE-2026-27749Avira Internet Security contains a deserialization of untrus…7.8
• CVE-2026-2775Mitigation bypass in the DOM: HTML Parser component. This vu…9.8