CVE-2026-27475
SPIP < 4.4.9 Insecure Deserialization
- State
- Published
- Severity
- 9.2 Critical
- Published
- Feb 19, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 19, 2026
Description
SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
SPIPSPIP |
|
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.htmlvendor-advisorypatch
- https://git.spip.net/spip/spipproduct
- VulnCheck Advisory: SPIP < 4.4.9 Insecure Deserializationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.