Which versions of SPIP are affected by CVE-2026-8429?

SPIP content management systems before version 4.4.14 contain a remote code execution vulnerability exploitable by authenticated administrators with no public exploit identified, creating risk of web…. A patch is available.

How to fix or mitigate CVE-2026-8429?

Within 24 hours, inventory all SPIP installations and document their current versions to determine scope of required patching. Within 7 days, apply vendor-released patch to upgrade all affected SPIP systems to version 4.4.14 or later, with testing performed in non-production environments prior to production deployment. Within 30 days, confirm successful patching across all systems, conduct forensic review of backend access logs and authentication events for any indicators of compromise, and establish a quarterly patch management schedule for ongoing SPIP security updates.

SPIP CVE-2026-8429

Q: What is the CVSS score of CVE-2026-8429?

CVE-2026-8429 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-29747 HIGH

Code Injection (CWE-94)

2026-05-12 VulnCheck

GHSA-pgpj-4fv5-cq78

RCE Code Injection Spip

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable backend with low complexity and no user interaction, but a low-privileged private-space account is required (PR:L); code execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:06 vuln.today

Patch available

May 12, 2026 - 20:03 EUVD

CVSS changed

May 12, 2026 - 19:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

May 12, 2026 - 18:32 nvd

HIGH 8.7

DescriptionCVE.org

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.

AnalysisAI

Remote code execution in SPIP versions before 4.4.14 lets authenticated users of the private space (backend) run arbitrary PHP in the web server context, bypassing SPIP's built-in security screen ("anti-intrusion") protections. The flaw is a CWE-94 code injection reported by VulnCheck and carries a CVSS 4.0 base score of 8.7; a vendor patch is available, though there is no public exploit identified at time of analysis and EPSS estimates only a 0.20% 30-day exploitation probability.

Technical ContextAI

SPIP is an open-source PHP-based content management and publishing system, widely used in French-speaking institutional and editorial sites. The affected component is the private space (the /ecrire administrative backend), reachable per the single CPE cpe:2.3:a:spip:spip. The root cause is CWE-94 (Improper Control of Generation of Code, i.e., code injection), meaning attacker-influenced input is incorporated into code that PHP subsequently evaluates or executes. Notably, the advisory states the exploit path bypasses SPIP's 'security screen' (a bundled filter/hardening layer intended to block known injection patterns), indicating the injection reaches an execution sink through a path the screen does not sanitize.

RemediationAI

Upgrade to SPIP 4.4.14, which the vendor identifies as the fixed release (Vendor-released patch: 4.4.14); consult the SPIP announcement at https://blog.spip.net/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/spip-prior-to-remote-code-execution-via-private-space for the exact upgrade path from your branch. Until patching is complete, reduce exposure of the private space: restrict network access to the /ecrire backend to trusted IPs or a VPN, enforce strong and unique credentials plus multi-factor or reverse-proxy authentication in front of it, and minimize the number of accounts holding private-space (editorial/admin) privileges since exploitation requires PR:L authenticated access. Be aware these controls constrain legitimate remote editors and do not remove the underlying injection, so they are stopgaps rather than a substitute for the 4.4.14 upgrade.