PT-2026-21862 · Spip · Spip+1

Valentin Lobstein + 1 · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-27747

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP interface traduction objets plugin versions prior to 4.3.3

Description The SPIP interface traduction objets plugin is susceptible to an authenticated SQL injection issue. The plugin does not properly validate input for the id parent parameter when processing translation requests, specifically within the interface traduction objets pipelines.php file. This parameter is directly incorporated into a SQL query using the sql getfetsel() function without appropriate sanitization or parameterization. An attacker with editor-level privileges can inject malicious SQL code through the id parent parameter, potentially leading to database disclosure or modification, and potentially denial of service.

Recommendations Update the SPIP interface traduction objets plugin to version 4.3.3 or later.

Exploit

Correção

DoS

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-27747

Produtos afetados

Spip

Interface Traduction Objets Plugin

Referências · 10

• 🔥 https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27747 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2026527583358026124 · Publicação no Twitter
• https://vulncheck.com/advisories/spip-interface-traduction-objets-authenticated-sql-injection · Nota
• https://plugins.spip.net/interface_traduction_objets · Nota
• https://t.me/CVEtracker/45688 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2026641360590155845 · Publicação no Twitter
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html · Aviso do Fabricante
• https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0be · Correção
• https://osv.dev/vulnerability/CVE-2026-27747 · Aviso do Fabricante