CVE-2026-8429 SPIP < 4.4.14 Remote Code Execution via Private Space
Attackers can execute arbitrary code on the web server via the private space, bypassing security protections in SPIP.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8429?
CVE-2026-8429 is a high-severity code injection vulnerability in SPIP, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.
Weakness: CWE-94
Which versions are affected by CVE-2026-8429?
How do I fix CVE-2026-8429?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-8429 being exploited?
There is no known exploitation of CVE-2026-8429 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-8429, GHSA-pgpj-4fv5-cq78, UBUNTU-CVE-2026-8429.