CVE-2026-27744
CRITICALSPIP tickets < 4.3.3 - Unauthenticated Remote Code Execution via Forum Preview Template Injection
Title source: llmDescription
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.
References (5)
Core 5
Core References
Various Sources technical-description
exploit
https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/
Various Sources vendor-advisory
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html
Various Sources product
https://plugins.spip.net/tickets
Patch patch
https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/spip-tickets-unauthenticated-rce
Scores
CVSS v3
9.8
EPSS
0.0091
EPSS Percentile
55.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (1)
spip/tickets
< 4.3.3
Published
Feb 25, 2026
Tracked Since
Feb 25, 2026