CVE-2026-27744CWE-94

SPIP tickets < 4.3.3 Unauthenticated RCE

Critical · published February 25, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01383 · 72.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-02-25T03:08Z
EPSS history
Timeline
  • 25 FEB 03:08Z
    SPIP tickets < 4.3.3 Unauthenticated RCE
    cvelistv5