Platform
php
Component
tickets
Fixed in
4.3.3
CVE-2026-27744 is a critical Remote Code Execution (RCE) vulnerability discovered in the SPIP Tickets plugin. This flaw allows an unauthenticated attacker to execute arbitrary code on a server hosting the plugin. The vulnerability impacts versions 0 through 4.3.3 of the plugin and is addressed with an upgrade to version 4.3.3.
The impact of CVE-2026-27744 is severe. An attacker can leverage this vulnerability to gain complete control over the web server hosting the SPIP Tickets plugin. This could involve data theft, modification of website content, installation of malware, or even complete system compromise. The lack of authentication required to exploit this vulnerability significantly broadens the attack surface, making it accessible to a wide range of threat actors. The use of unfiltered environment rendering (#ENV**) amplifies the risk, allowing for complex code injection and execution within the SPIP template processing chain. This vulnerability shares similarities with other template injection vulnerabilities where untrusted data is directly incorporated into rendered output without proper sanitization.
CVE-2026-27744 was publicly disclosed on 2026-02-25. There are currently no known public exploits or active campaigns targeting this vulnerability, however, the critical severity and ease of exploitation suggest it is a high-priority target. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept code is likely to emerge given the vulnerability's nature and severity.
Exploit Status
EPSS
0.37% (59% percentile)
CISA SSVC
The primary mitigation for CVE-2026-27744 is to immediately upgrade the SPIP Tickets plugin to version 4.3.3 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the complexity of the injection point, carefully reviewing and restricting user input in the forum preview functionality can reduce the attack surface. Disabling the public ticket preview feature, if not essential, is another potential short-term mitigation. After upgrading, confirm the vulnerability is resolved by attempting to reproduce the exploit scenario with a test payload; successful mitigation should prevent code execution.
Actualice el plugin SPIP tickets a la versión 4.3.3 o superior. Esta versión corrige la vulnerabilidad de ejecución remota de código no autenticada. La actualización se puede realizar a través del panel de administración de SPIP o descargando la última versión del plugin desde el repositorio oficial.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27744 is a critical Remote Code Execution vulnerability in the SPIP Tickets plugin, allowing unauthenticated attackers to execute code on the server.
You are affected if you are using SPIP Tickets plugin versions 0 through 4.3.3. Upgrade to 4.3.3 to mitigate the risk.
Upgrade the SPIP Tickets plugin to version 4.3.3 or later. Consider temporary workarounds like disabling the public ticket preview if immediate upgrade is not possible.
Currently, there are no confirmed active exploits, but the vulnerability's severity makes it a likely target.
Refer to the official SPIP security advisory for detailed information and updates regarding CVE-2026-27744.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.