CVE-2026-27475: SPIP < 4.4.9 Insecure Deserialization
SPIP before 4.4.9 allows Insecure Deserialization in the public area through the tablevaleur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27475?
CVE-2026-27475 is categorized as a critical severity vulnerability due to the potential for arbitrary code execution through insecure deserialization.
How do I fix CVE-2026-27475?
To fix CVE-2026-27475, upgrade to SPIP version 4.4.9 or later where the vulnerability is patched.
What kind of attacks can exploit CVE-2026-27475?
CVE-2026-27475 can be exploited for remote code execution if an attacker can deliver malicious serialized data to the affected SPIP site.
Who is affected by CVE-2026-27475?
Any installations of SPIP versions prior to 4.4.9 are affected by CVE-2026-27475.
What is the nature of the vulnerability in CVE-2026-27475?
CVE-2026-27475 involves insecure deserialization due to accepting untrusted serialized data, leading to potential arbitrary object manipulation.