CVE-2026-27475 SPIP < 4.4.9 Insecure Deserialization
An attacker with prior access can exploit insecure deserialization in SPIP to achieve arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27475?
CVE-2026-27475 is a critical unsafe deserialization vulnerability in Spip Spip, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another vulnerability) can trigger arbitrary object instantiation and potentially achieve code execution. The use of serialized data in these components has been deprecated and will be removed in SPIP 5. This vulnerability is not mitigated by the SPIP security screen.
Weakness: CWE-502
Which versions are affected by CVE-2026-27475?
It affects 1 product.
Products include Spip Spip.
How do I fix CVE-2026-27475?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-27475 being exploited?
There is no known exploitation of CVE-2026-27475 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Spip Spip
Sources
Also known as DEBIAN-CVE-2026-27475, GHSA-hxjp-v4qc-fcjg, UBUNTU-CVE-2026-27475.