PT-2026-21862 · Spip · Spip+1

Valentin Lobstein + 1 · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-27747

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP interface traduction objets plugin versions prior to 4.3.3

Description The SPIP interface traduction objets plugin is susceptible to an authenticated SQL injection issue. The plugin does not properly validate input for the id parent parameter when processing translation requests, specifically within the interface traduction objets pipelines.php file. This parameter is directly incorporated into a SQL query using the sql getfetsel() function without appropriate sanitization or parameterization. An attacker with editor-level privileges can inject malicious SQL code through the id parent parameter, potentially leading to database disclosure or modification, and potentially denial of service.

Recommendations Update the SPIP interface traduction objets plugin to version 4.3.3 or later.

Exploit

Fix

DoS

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27747

Affected Products

Spip

Interface Traduction Objets Plugin

References · 10

• 🔥 https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27747 · Security Note
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html · Vendor Advisory
• https://git.spip.net/spip-contrib-extensions/interface_traduction_objets/-/commit/db3417b7811774f04c3ff191ca1737fe660ef0be · Patch
• https://osv.dev/vulnerability/CVE-2026-27747 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2026527583358026124 · Twitter Post
• https://vulncheck.com/advisories/spip-interface-traduction-objets-authenticated-sql-injection · Note
• https://plugins.spip.net/interface_traduction_objets · Note
• https://t.me/CVEtracker/45688 · Telegram Post
• https://twitter.com/CVEnew/status/2026641360590155845 · Twitter Post