Which versions of SPIP are affected by EUVD-2026-29748?

A critical vulnerability in SPIP content management system (versions before 4.4.14) enables remote attackers to execute arbitrary commands within your web application, creating risk of data theft,…. A patch is available.

How to fix or mitigate EUVD-2026-29748?

Within 24 hours: Inventory all SPIP installations in your organization, prioritizing those with internet-facing public exposure, and verify which versions are deployed and which nginx configurations are in use. Begin testing SPIP 4.4.14 or later in a non-production environment to ensure compatibility with your current setup. Within 7 days: Complete security and functionality testing of the patched version, then deploy SPIP 4.4.14 or later to all production systems, starting with internet-facing instances. Within 30 days: Verify 100% patch compliance across all SPIP installations, review nginx configuration hardening recommendations from the SPIP project, enable detailed application logging to detect exploitation attempts, and conduct a code review audit on custom SPIP extensions to identify any similar injection vulnerabilities.

SPIP EUVD-2026-29748

Q: What is the CVSS score of EUVD-2026-29748?

EUVD-2026-29748 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-8430 CRITICAL

Code Injection (CWE-94)

2026-05-12 VulnCheck

GHSA-qjjx-7vj9-gr7c

RCE Code Injection Nginx Spip

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network vector with no auth or interaction, but AC:H because exploitation depends on a specific non-default nginx configuration; total confidentiality, integrity, and availability impact from RCE with no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:59 vuln.today

Patch available

May 12, 2026 - 20:03 EUVD

Severity Changed

May 12, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

May 12, 2026 - 19:22 NVD

8.1 (HIGH) 9.2 (CRITICAL)

CVE Published

May 12, 2026 - 18:43 nvd

CRITICAL 9.2

DescriptionCVE.org

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx configuration scenarios to achieve code execution, and this issue is not mitigated by the SPIP security screen.

AnalysisAI

Remote code execution in SPIP versions before 4.4.14 lets network attackers run arbitrary code as the web server user through the public space, but only when the CMS runs behind certain nginx configurations. The flaw (CWE-94 code injection) bypasses SPIP's built-in security screen, so that mitigation offers no protection. It was reported by VulnCheck and carries a CVSS 4.0 score of 9.2, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none.

Technical ContextAI

SPIP is an open-source PHP content management/publishing system widely used for editorial and associative websites. The vulnerability is a CWE-94 'Improper Control of Generation of Code' (code injection) issue in the publicly accessible 'public space' of the application. Per the advisory, exploitability is gated by how the front-end nginx reverse proxy/web server is configured - likely a request-routing or path-handling nuance in specific nginx rewrite/location setups that allows attacker-controlled input to reach a code-evaluation path in PHP. The single CPE 'cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*' confirms the SPIP application itself is the affected component, and notably the SPIP security screen (an anti-intrusion filter) does not block this vector.

RemediationAI

Upgrade to SPIP 4.4.14 or later, which is the vendor-released patch that resolves this issue (Vendor-released patch: 4.4.14); consult the SPIP blog at https://blog.spip.net/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/spip-prior-to-remote-code-execution-via-nginx for release details. Because the issue is not blocked by the SPIP security screen, do not rely on that filter as a control. Where immediate patching is not possible, audit and harden the nginx front-end configuration to remove the vulnerable request-handling pattern - tighten location/rewrite rules so raw or ambiguous paths cannot reach SPIP's public-space code paths, and restrict access to the public space via WAF rules or IP allow-listing; note these nginx changes risk breaking legitimate URL rewriting and clean-URL routing, so test in staging before applying to production.