Unrated severityNVD Advisory· Published Feb 25, 2026· Updated Mar 5, 2026
SPIP tickets < 4.3.3 Unauthenticated RCE
CVE-2026-27744
Description
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.
Affected products
2- SPIP/ticketsv5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7mitrepatch
- chocapikk.com/posts/2026/spip-plugins-vulnerabilities/mitretechnical-descriptionexploit
- blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlmitrevendor-advisory
- www.vulncheck.com/advisories/spip-tickets-unauthenticated-rcemitrethird-party-advisory
- plugins.spip.net/ticketsmitreproduct
News mentions
0No linked articles in our index yet.