CVE-2026-27745

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an underscore bypass protection mechanisms and the hidden content is rendered with filtering disabled, an authenticated attacker with editor-level privileges can inject crafted content that is evaluated through SPIP's template processing chain, resulting in execution of code in the context of the web server.

• CWE-94

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlRelease Notes
• https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/Third Party Advisory
• https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0bePatch
• https://plugins.spip.net/interface_traduction_objetsProduct
• https://www.vulncheck.com/advisories/spip-interface-traduction-objets-authenticated-rceThird Party Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2774Integer overflow in the Audio/Video component. This vulnerab…9.8
• CVE-2026-27740Discourse is an open-source discussion platform. Versions pr…6.1
• CVE-2026-27741Bludit version 3.16.1 contains a cross-site request forgery …4.3
• CVE-2026-27742Bludit version 3.16.2 contains a stored cross-site scripting…5.4
• CVE-2026-27743The SPIP referer_spam plugin versions prior to 1.3.0 contain…9.8
• CVE-2026-27744The SPIP tickets plugin versions prior to 4.3.3 contain an u…9.8
• CVE-2026-27746The SPIP jeux plugin versions prior to 4.1.1 contain a refle…6.1
• CVE-2026-27747The SPIP interface_traduction_objets plugin versions prior t…8.8
• CVE-2026-27748Avira Internet Security contains an improper link resolution…7.1
• CVE-2026-27749Avira Internet Security contains a deserialization of untrus…7.8
• CVE-2026-2775Mitigation bypass in the DOM: HTML Parser component. This vu…9.8
• CVE-2026-27750Avira Internet Security contains a time-of-check time-of-use…7