Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-27744
PUBLISHED
More InfoOfficial Page
Assigner-VulnCheck
Assigner Org ID-83251b91-4cc7-4094-a5c7-464a1b83ea10
View Known Exploited Vulnerability (KEV) details
Published At-25 Feb, 2026 | 03:08
Updated At-26 Feb, 2026 | 19:55
Rejected At-
▼CVE Numbering Authority (CNA)
SPIP tickets < 4.3.3 Unauthenticated RCE

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.

Affected Products
Vendor
SPIP
Product
tickets
Repo
https://git.spip.net/spip-contrib-extensions/tickets
Default Status
unaffected
Versions
Affected
  • From 0 before 4.3.3 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-94CWE-94 Improper Control of Generation of Code ('Code Injection')
Type: CWE
CWE ID: CWE-94
Description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Metrics
VersionBase scoreBase severityVector
4.09.3CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 4.0
Base score: 9.3
Base severity: CRITICAL
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Valentin Lobstein (Chocapikk)
coordinator
VulnCheck
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/
technical-description
exploit
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html
vendor-advisory
https://plugins.spip.net/tickets
product
https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7
patch
https://www.vulncheck.com/advisories/spip-tickets-unauthenticated-rce
third-party-advisory
Hyperlink: https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/
Resource:
technical-description
exploit
Hyperlink: https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html
Resource:
vendor-advisory
Hyperlink: https://plugins.spip.net/tickets
Resource:
product
Hyperlink: https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7
Resource:
patch
Hyperlink: https://www.vulncheck.com/advisories/spip-tickets-unauthenticated-rce
Resource:
third-party-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found