CVE-2026-27744: Spip Tickets remote code execution (CVSS 9.8)

Description

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As a result, an unauthenticated attacker can inject crafted content that is evaluated through SPIP's template processing chain, leading to execution of code in the context of the web server.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Spip Tickets< 4.3.3

Remediation

Fixed in

Spip Tickets≥ 4.3.3

Patch & vendor advisories

https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7

References

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlRelease Notes
https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/Third Party Advisory
https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7Patch
https://plugins.spip.net/ticketsProduct
https://www.vulncheck.com/advisories/spip-tickets-unauthenticated-rceThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-27744 being actively exploited?

CVE-2026-27744 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.35%.

How severe is CVE-2026-27744?

CVE-2026-27744 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 1.35% probability of exploitation.

Which products are affected by CVE-2026-27744?

Affected products include Spip Tickets.

How do I fix CVE-2026-27744?

Upgrade affected software to a fixed version, for example Spip Tickets 4.3.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-27744 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo