What’s Vulnerable › Vulnerabilities

CVE-2026-27475: SPIP < 4.4.9 Insecure Deserialization

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-19 · updated 2026-06-17
• Weakness: CWE-502

Description

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.

Affected products

• SPIP: from 4.4.0 before 4.4.9 — fixed in 4.4.9

How to fix

Upgrade to a fixed version: SPIP 4.4.9. Check the vendor advisory for mitigations.

References

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html
• https://git.spip.net/spip/spip
• https://www.vulncheck.com/advisories/spip-insecure-deserialization

Get alerted when CVE-2026-27475 or the next vulnerability affects your stack