Vulnerability details

CVE-2026-27475

SPIP SPIP

SPIP < 4.4.9 Insecure Deserialization

CVSS 4.0

9.2Critical

Official description

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
SPIP	SPIP	4.4.0 ≤ v < 4.4.9	CVEProject cvelistV5 (CNA)

References and advisories

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html vendor-advisorypatch
https://git.spip.net/spip/spip product
https://www.vulncheck.com/advisories/spip-insecure-deserialization third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-19
Last updated: 2026-03-05
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.91%

Probability of exploitation in 30 days

60.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total