Vulnerability Description
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Spip | Spip | < 4.4.10 |
Related Weaknesses (CWE)
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlRelease Notes
- https://git.spip.net/spip/spipProduct
- https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tagsThird Party Advisory
FAQ
What is CVE-2026-22205?
CVE-2026-22205 is a vulnerability with a CVSS score of 7.5 (HIGH). SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit lo...
How severe is CVE-2026-22205?
CVE-2026-22205 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22205?
Check the references section above for vendor advisories and patch information. Affected products include: Spip Spip.