CVE-2026-26223: SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area
SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does not properly sandbox or escape iframe content in the back-office, allowing an attacker to inject and execute malicious scripts. The fix adds a sandbox attribute to iframe tags in the private area. This vulnerability is not mitigated by the SPIP security screen.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26223?
CVE-2026-26223 is classified as a high severity vulnerability due to its potential for XSS attacks in the private area of SPIP.
How do I fix CVE-2026-26223?
To fix CVE-2026-26223, update SPIP to version 4.4.8 or later, which implements the necessary changes to sandbox iframe tags.
Where can CVE-2026-26223 be exploited?
CVE-2026-26223 can be exploited in the private area of SPIP, allowing attackers to inject malicious scripts through iframe tags.
What types of attacks does CVE-2026-26223 allow?
CVE-2026-26223 allows Cross-Site Scripting (XSS) attacks, which can lead to unauthorized access and data theft.
Which versions of SPIP are affected by CVE-2026-26223?
CVE-2026-26223 affects SPIP versions prior to 4.4.8.