CVE-2026-27474: SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)
SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappeantixss() function was not systematically applied to input, form, button, and anchor (a) HTML tags, allowing an attacker to inject malicious scripts through these elements. This vulnerability is not mitigated by the SPIP security screen.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27474?
CVE-2026-27474 is classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2026-27474?
To fix CVE-2026-27474, update SPIP to version 4.4.9 or later, which includes a complete fix for the XSS issue.
What types of attacks can CVE-2026-27474 facilitate?
CVE-2026-27474 can facilitate Cross-Site Scripting (XSS) attacks that allow attackers to inject malicious scripts via specific HTML tags.
What versions of SPIP are affected by CVE-2026-27474?
CVE-2026-27474 affects all versions of SPIP prior to 4.4.9.
What areas of SPIP are vulnerable in CVE-2026-27474?
CVE-2026-27474 affects the private area of SPIP, particularly forms, buttons, and anchor tags.