CVE-2026-8429

HIGH 8.8

SPIP < 4.4.14 Remote Code Execution via Private Space

CVSS Score

8.8

EPSS Score

0.2%

EPSS Percentile

42th

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.

CWE	CWE-94
Vendor	spip
Product	spip
Published	May 12, 2026
Last Updated	May 13, 2026

Stay Ahead of the Next One

Get instant alerts for spip spip

Be the first to know when new high vulnerabilities affecting spip spip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SPIP / SPIP

0 < 4.4.14

References

NVD ↗ CVE.org ↗ EPSS Data ↗

blog.spip.net: https://blog.spip.net/ vulncheck.com: https://www.vulncheck.com/advisories/spip-prior-to-remote-code-execution-via-private-space

Credits

Louka Jacques-Chevallier