Platform
php
Component
interface_traduction_objets
Fixed in
2.2.2
CVE-2026-27745 describes a Remote Code Execution (RCE) vulnerability discovered in the SPIP interfacetraductionobjets plugin. This flaw allows an authenticated attacker with editor-level privileges to execute arbitrary code on a vulnerable system. The vulnerability affects versions prior to 2.2.2 and has been publicly disclosed. A fix is available in version 2.2.2.
The impact of this vulnerability is significant. An attacker who can successfully exploit CVE-2026-27745 can achieve remote code execution on the server hosting the SPIP website. This could lead to complete compromise of the system, including data theft, modification, or deletion. The attacker would need to be authenticated with editor-level privileges, but once authenticated, the attack is relatively straightforward. The ability to execute arbitrary code allows for a wide range of malicious activities, including installing backdoors, creating new administrator accounts, and launching further attacks against other systems on the network. This vulnerability shares similarities with other template injection vulnerabilities where unfiltered user input is processed by the application's templating engine.
CVE-2026-27745 was publicly disclosed on 2026-02-25. There are currently no known public proof-of-concept exploits available, but the vulnerability's ease of exploitation suggests that it could become a target for opportunistic attackers. The vulnerability is not currently listed on CISA KEV. Given the RCE nature and the relatively simple attack vector, it is considered a high-priority vulnerability.
Exploit Status
EPSS
0.12% (31% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-27745 is to upgrade the SPIP interfacetraductionobjets plugin to version 2.2.2 or later. If an immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the plugin's specific workflow, carefully scrutinizing input to the translation interface for suspicious characters or patterns could provide some limited protection. Review SPIP's output filtering configuration to ensure it is enabled and configured correctly. After upgrading, verify the fix by attempting to inject a simple payload into the translation interface and confirming that it is properly sanitized and does not result in code execution.
Actualice el plugin interface_traduction_objets a la versión 2.2.2 o superior. Esta versión corrige la vulnerabilidad de ejecución remota de código. Puede actualizar el plugin a través del panel de administración de SPIP.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27745 is a Remote Code Execution vulnerability in the SPIP interfacetraductionobjets plugin, allowing authenticated attackers to execute code.
You are affected if you are using SPIP with the interfacetraductionobjets plugin in versions 0–2.2.2.
Upgrade the interfacetraductionobjets plugin to version 2.2.2 or later to resolve the vulnerability.
While no public exploits are currently known, the vulnerability's ease of exploitation suggests it could become a target.
Refer to the official SPIP security advisory for detailed information and updates regarding CVE-2026-27745.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.