CVE-2026-27744: SPIP tickets < 4.3.3 Unauthenticated RCE
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27744?
CVE-2026-27744 is considered a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2026-27744?
To fix CVE-2026-27744, upgrade the SPIP tickets plugin to version 4.3.3 or later.
What versions are affected by CVE-2026-27744?
CVE-2026-27744 affects all versions of the SPIP tickets plugin prior to 4.3.3.
Can CVE-2026-27744 be exploited remotely?
Yes, CVE-2026-27744 can be exploited remotely without authentication.
What are the risks of not addressing CVE-2026-27744?
Not addressing CVE-2026-27744 leaves the application vulnerable to remote code execution attacks, which can lead to full system compromise.