PT-2026-20853 · Spip · Spip

Arthur Deloffre + 2 · Published 2026-01-01 · Updated 2026-02-23 · CVE-2026-26223

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.8

Description The application does not properly handle iframe content in the private area, allowing an attacker to inject and execute malicious scripts through iframe tags. The issue occurs because the application does not sandbox or escape iframe content in the back-office. The fix involves adding a sandbox attribute to iframe tags within the private area. This issue is not addressed by the SPIP security screen.

Recommendations Update to SPIP version 4.4.8 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26223

Affected Products

Spip

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26223 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26223 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26223 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-26223 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26223 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26223 · Vendor Advisory
• https://twitter.com/CVEnew/status/2025892057001124259 · Twitter Post
• https://git.spip.net/spip/spip · Note
• https://t.me/CVEtracker/45139 · Telegram Post
• https://vulncheck.com/advisories/spip-cross-site-scripting-via-iframe-tags-in-private-area · Note
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-8.html · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2024538053839057016 · Twitter Post