CVE-2026-27475

🗓️ 19 Feb 2026 18:39:24Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 16 Views🌐 WEB

Insecure deserialization in SPIP prior to 4.4.9 via table valeur filter and DATA iterator, risk of code execution.

Reporter	Title	Published	Views	Family All 20
ATTACKERKB	CVE-2026-27475	19 Feb 202618:39	–	attackerkb
Information Security Automation	March Linux Patch Wednesday	30 Mar 202620:00	–	avleonov
Circl	CVE-2026-27475	19 Feb 202619:34	–	circl
CNNVD	SPIP 安全漏洞	19 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-27475 SPIP < 4.4.9 Insecure Deserialization	19 Feb 202618:39	–	cvelist
Debian	[SECURITY] [DSA 6155-1] spip security update	3 Mar 202610:30	–	debian
Debian CVE	CVE-2026-27475	19 Feb 202618:39	–	debiancve
Tenable Nessus	Debian dsa-6155 : spip - security update	5 Mar 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-27475	19 Feb 202600:00	–	nessus
NVD	CVE-2026-27475	19 Feb 202619:22	–	nvd

NVD

Vulners

CNA

Node

spip spipRange4.4.0–4.4.9

[
  {
    "defaultStatus": "unaffected",
    "product": "SPIP",
    "vendor": "SPIP",
    "versions": [
      {
        "lessThan": "4.4.9",
        "status": "affected",
        "version": "4.4.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/spip-insecure-deserialization
blog	www.blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html
git	www.git.spip.net/spip/spip

Parameter	Position	Path	Description	CWE
var_data	query param	/?page=article	Deserialization of user-supplied serialized PHP object via var_data parameter leading to potential gadget chain execution	CWE-502

05 Mar 2026 01:31Current

6Medium risk

Vulners AI Score6

CVSS 3.18.1

CVSS 49.2

EPSS0.00193

SSVC

CWE-502