PT-2026-21860 · Spip · Spip+1

Valentin Lobstein + 1 · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-27745

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP interface traduction objets plugin versions prior to 2.2.2 SPIP interface traduction objets plugin versions 2.2.2 through 4.3.3

Description The SPIP interface traduction objets plugin contains an authenticated remote code execution issue in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Fields prefixed with an underscore bypass protection mechanisms, and the hidden content is rendered with filtering disabled. This allows an authenticated attacker with editor-level privileges to inject crafted content that is evaluated through SPIP's template processing chain, resulting in code execution in the context of the web server.

Recommendations Update the SPIP interface traduction objets plugin to version 2.2.2 or later. Update the SPIP interface traduction objets plugin to version 4.3.3 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-27745

Affected Products

Spip

Interface Traduction Objets

References · 12

• 🔥 https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27745 · Security Note
• https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0be · Patch
• https://osv.dev/vulnerability/CVE-2026-27745 · Vendor Advisory
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2026721828040048671 · Twitter Post
• https://vulncheck.com/advisories/spip-interface-traduction-objets-authenticated-rce · Note
• https://twitter.com/CVEnew/status/2026641358602088635 · Twitter Post
• https://t.me/cveNotify/153585 · Telegram Post
• https://plugins.spip.net/interface_traduction_objets · Note
• https://t.me/CVEtracker/45686 · Telegram Post
• https://twitter.com/cracbot/status/2028425216125538707 · Twitter Post