Plataforma
php
Componente
interface_traduction_objets
Corrigido em
2.2.2
CVE-2026-27745 describes a Remote Code Execution (RCE) vulnerability discovered in the SPIP interfacetraductionobjets plugin. This flaw allows an authenticated attacker with editor-level privileges to execute arbitrary code on a vulnerable system. The vulnerability affects versions prior to 2.2.2 and has been publicly disclosed. A fix is available in version 2.2.2.
The impact of this vulnerability is significant. An attacker who can successfully exploit CVE-2026-27745 can achieve remote code execution on the server hosting the SPIP website. This could lead to complete compromise of the system, including data theft, modification, or deletion. The attacker would need to be authenticated with editor-level privileges, but once authenticated, the attack is relatively straightforward. The ability to execute arbitrary code allows for a wide range of malicious activities, including installing backdoors, creating new administrator accounts, and launching further attacks against other systems on the network. This vulnerability shares similarities with other template injection vulnerabilities where unfiltered user input is processed by the application's templating engine.
CVE-2026-27745 was publicly disclosed on 2026-02-25. There are currently no known public proof-of-concept exploits available, but the vulnerability's ease of exploitation suggests that it could become a target for opportunistic attackers. The vulnerability is not currently listed on CISA KEV. Given the RCE nature and the relatively simple attack vector, it is considered a high-priority vulnerability.
Websites using SPIP CMS with the interfacetraductionobjets plugin installed and running versions 0–2.2.2 are at risk. This includes websites with custom translation workflows or those that allow editors to directly modify translation data. Shared hosting environments using SPIP are particularly vulnerable as they may not have control over plugin updates.
• wordpress / composer / npm:
grep -r "interface_traduction_objets" /var/www/html/• generic web:
curl -I http://your-spip-site.com/plugins/interface_traduction_objets/• generic web: Examine access logs for POST requests to the translation interface with unusual or potentially malicious data in the form fields.
disclosure
Status do Exploit
EPSS
0.12% (percentil 31%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2026-27745 is to upgrade the SPIP interfacetraductionobjets plugin to version 2.2.2 or later. If an immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the plugin's specific workflow, carefully scrutinizing input to the translation interface for suspicious characters or patterns could provide some limited protection. Review SPIP's output filtering configuration to ensure it is enabled and configured correctly. After upgrading, verify the fix by attempting to inject a simple payload into the translation interface and confirming that it is properly sanitized and does not result in code execution.
Actualice el plugin interface_traduction_objets a la versión 2.2.2 o superior. Esta versión corrige la vulnerabilidad de ejecución remota de código. Puede actualizar el plugin a través del panel de administración de SPIP.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2026-27745 is a Remote Code Execution vulnerability in the SPIP interfacetraductionobjets plugin, allowing authenticated attackers to execute code.
You are affected if you are using SPIP with the interfacetraductionobjets plugin in versions 0–2.2.2.
Upgrade the interfacetraductionobjets plugin to version 2.2.2 or later to resolve the vulnerability.
While no public exploits are currently known, the vulnerability's ease of exploitation suggests it could become a target.
Refer to the official SPIP security advisory for detailed information and updates regarding CVE-2026-27745.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.