CVE-2026-27744: SPIP Tickets Plugin Unauthenticated Code Injection RCE

Overview

The SPIP Tickets plugin for the SPIP content management system is affected by CVE-2026-27744. According to the record, the plugin versions prior to 4.3.3 handle untrusted request parameters in the forum preview feature for public ticket pages in a way that allows code injection (CWE-94). The record describes the flaw as an unauthenticated remote code execution issue.

Impact

• The description states that injected content is evaluated through SPIP's template processing chain, which may lead to code execution in the context of the web server.
• NVD records a CVSS 3.1 base score of 9.8 with severity critical. The recorded vector indicates network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
• Because the attack does not require authentication, exposure of public ticket pages is the main factor for risk assessment.

Affected products and versions

• Product recorded in the sources: Spip Tickets.
• Affected range recorded: before 4.3.3.
• The fix reference points to a patch commit in the SPIP contrib extensions repository. The record lists 4.3.3 as the version boundary.
• Whether other branches or older releases receive separate backports is not stated in the record.

Exploitation status

• CISA KEV: the record shows the vulnerability is not listed in KEV. No confirmed active exploitation appears in the sources consulted.
• The SSVC data in the record lists exploitation as proof of concept and automatable as yes. This indicates that public proof-of-concept material is considered possible, but it is not evidence of exploitation in the wild.
• A third-party technical write-up is listed in the references. This portal does not reproduce technical details.

Remediation and mitigation

• Update the SPIP Tickets plugin to version 4.3.3 or a later release, as the record indicates the issue is fixed from that boundary.
• Review the patch commit linked in the record to confirm the change applied in your installation.
• Until the update is applied, limit exposure of public ticket pages where operationally feasible and review the plugin inventory of all SPIP sites.

Detection guidance

• Review web server and application logs for unusual requests to public ticket and forum preview paths, particularly requests with unexpected or unusually long parameters.
• Monitor for unexpected file creation or modification within the SPIP installation and its cache or template directories.
• Treat any unexplained process activity from the web server account as a potential sign of compromise and escalate to incident response.

Limitations of the available information

• The record does not describe the full set of exploit conditions, the exact vulnerable code path, or the complete list of tested SPIP core versions.
• It is unknown from the record whether backports exist for other supported branches.
• The EPSS entry carries a date later than the publication date. This should be verified against the EPSS source before relying on it for prioritization.
• Without vendor confirmation of all affected configurations, administrators should verify their own deployments.

Frequently asked questions

What is CVE-2026-27744?

It is a critical unauthenticated code injection vulnerability in the SPIP Tickets plugin, recorded as allowing remote code execution in the web server context for versions before 4.3.3.

Which version fixes the issue?

The record lists 4.3.3 as the fixed version boundary and links to a patch commit. Administrators should update to 4.3.3 or a later release.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. SSVC data lists exploitation as proof of concept.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.