Vulnerability Description
SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, form, button, and anchor (a) HTML tags, allowing an attacker to inject malicious scripts through these elements. This vulnerability is not mitigated by the SPIP security screen.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Spip | Spip | >= 4.4.0, < 4.4.9 |
Related Weaknesses (CWE)
References
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.htmlRelease NotesVendor Advisory
- https://git.spip.net/spip/spipProduct
- https://www.vulncheck.com/advisories/spip-cross-site-scripting-in-private-area-iThird Party Advisory
FAQ
What is CVE-2026-27474?
CVE-2026-27474 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, form,...
How severe is CVE-2026-27474?
CVE-2026-27474 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27474?
Check the references section above for vendor advisories and patch information. Affected products include: Spip Spip.