SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplet… (CVE-2026-27474)

Summary

SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)

Original description

The description as published by the source.

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, form, button, and anchor (a) HTML tags, allowing an attacker to inject malicious scripts through these elements. This vulnerability is not mitigated by the SPIP security screen.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-27474 spip
Ubuntu UBUNTU-CVE-2026-27474 spip

References

advisory github.com
advisory nvd.nist.gov
advisory vulncheck.com
patch blog.spip.net
web git.spip.net