CVE-2026-8429highCWE-94

CVE-2026-8429: high-severity vulnerability in SPIP

SPIP < 4.4.14 Remote Code Execution via Private Space

Published · Updated

Follow this CVE+ Monitor SPIP+ Monitor spip

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
SPIP · SPIP
Related CVEs — SPIP

In the same product, most dangerous first.

CVE-2024-8517CRITICALSPIP Bigup Multipart File Upload OS Command InjectionEPSS 94.5%CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2026-77806CRITICALCVE-2026-77806EPSS 4.5%CVE-2026-77647CRITICALCVE-2026-77647EPSS 2.3%CVE-2026-72710CRITICALSPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionEPSS 1.1%CVE-2026-27475CRITICALSPIP < 4.4.9 Insecure DeserializationEPSS 0.9%