What is the CVSS score of CVE-2026-27745?

CVE-2026-27745 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Interface Traduction Objets are affected by CVE-2026-27745?

SPIP installations using the interface_traduction_objets plugin (versions before 2.2.2) are vulnerable to authenticated remote code execution, allowing attackers with valid credentials to execute…. A patch is available.

How to fix or mitigate CVE-2026-27745?

Within 24 hours: Identify all SPIP instances using interface_traduction_objets plugin and document current versions. Within 7 days: Apply vendor patch to upgrade plugin to version 2.2.2 or later on all affected systems; prioritize production environments. Within 30 days: Conduct post-patch validation testing and review access logs for suspicious translation workflow activity dating back 90 days to detect potential exploitation.

Interface Traduction Objets CVE-2026-27745

HIGH

Code Injection (CWE-94)

2026-02-25 disclosure@vulncheck.com

RCE Interface Traduction Objets

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 27, 2026 - 20:40 nvd

Patch available

CVE Published

Feb 25, 2026 - 04:16 nvd

HIGH 8.8

DescriptionCVE.org

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an underscore bypass protection mechanisms and the hidden content is rendered with filtering disabled, an authenticated attacker with editor-level privileges can inject crafted content that is evaluated through SPIP's template processing chain, resulting in execution of code in the context of the web server.

AnalysisAI

Remote code execution in SPIP's interface_traduction_objets plugin prior to version 2.2.2 allows authenticated editors to execute arbitrary code by injecting malicious content into unfiltered form fields that bypass output protection mechanisms. The vulnerability exploits how underscore-prefixed fields circumvent SPIP's security filters and are processed through the template engine without sanitization. An attacker with editor-level privileges can leverage this to achieve full code execution within the web server context.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects the translation component of Interface Traduction Objets. The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an underscore bypass protection mechanisms and the hidden content is rendered with filtering disabled, an authenticated attacker with editor-level privileges can inject crafted conten