Catalogue CVE

CVE-2026-27474

UBUNTU-

[Catalogue CVE]

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8. The echappe_anti_xss() function was not systematically applied to input, form, button, and anchor (a) HTML tags, allowing an attacker to inject malicious scripts through these elements. This vulnerability is not mitigated by the SPIP security screen.

Gravité
Inconnu
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debian14spip4.4.9+dfsg-1Fixed[DEBIAN-CVE-2026-27474]
Debian13spip4.4.11+dfsg-0+deb13u1Fixed[DEBIAN-CVE-2026-27474]

Showing 2 fix observations. All 38 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debian13spip4.4.10+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.11+dfsg-0+deb13u1Fixed[DEBIAN-CVE-2026-27474]
Debian13spip4.4.3+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.3+dfsg-1+deb13u1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.4+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.5+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.6+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.7+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.8+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian13spip4.4.9+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.3+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.4+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.5+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.6+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.7+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.8+dfsg-1Affected[DEBIAN-CVE-2026-27474]
Debian14spip4.4.9+dfsg-1Fixed[DEBIAN-CVE-2026-27474]
Ubuntu22.04spip3.2.11-3Affected[UBUNTU-CVE-2026-27474]
Ubuntu22.04spip3.2.12-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu22.04spip4.0.2-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu22.04spip4.0.4-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu24.04spip4.1.11+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu24.04spip4.1.12+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu24.04spip4.1.13+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu24.04spip4.1.15+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu24.04spip4.2.9+dfsg-2Affected[UBUNTU-CVE-2026-27474]
Ubuntu25.10spip4.3.8+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu25.10spip4.4.3+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu26.04spip4.4.3+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu26.04spip4.4.6+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu26.04spip4.4.7+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu26.04spip4.4.8+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntu26.04spip4.4.9+dfsg-1Affected[UBUNTU-CVE-2026-27474]
Ubuntuprospip3.2.4-1Affected[UBUNTU-CVE-2026-27474]
Ubuntuprospip3.2.5-1Affected[UBUNTU-CVE-2026-27474]
Ubuntuprospip3.2.7-1Affected[UBUNTU-CVE-2026-27474]
Ubuntuprospip3.2.7-1ubuntu0.1Affected[UBUNTU-CVE-2026-27474]
Ubuntuprospip3.2.7-1ubuntu0.1+esm2Affected[UBUNTU-CVE-2026-27474]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "spip",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.11+dfsg-0+deb13u1"
            }
          ]
        }
      ],
      "release": "13",
      "versions": [
        "4.4.10+dfsg-1",
        "4.4.3+dfsg-1",
        "4.4.3+dfsg-1+deb13u1",
        "4.4.4+dfsg-1",
        "4.4.5+dfsg-1",
        "4.4.6+dfsg-1",
        "4.4.7+dfsg-1",
        "4.4.8+dfsg-1",
        "4.4.9+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-27474",
      "fixed_version": "4.4.11+dfsg-0+deb13u1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-27474",
      "provider_updated_at": "2026-10-01T03:03:01.131000102Z"
    },
    {
      "name": "spip",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.9+dfsg-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "4.4.3+dfsg-1",
        "4.4.4+dfsg-1",
        "4.4.5+dfsg-1",
        "4.4.6+dfsg-1",
        "4.4.7+dfsg-1",
        "4.4.8+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-27474",
      "fixed_version": "4.4.9+dfsg-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-27474",
      "provider_updated_at": "2026-10-01T03:03:01.131000102Z"
    },
    {
      "name": "spip",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "3.2.4-1",
        "3.2.5-1",
        "3.2.7-1",
        "3.2.7-1ubuntu0.1",
        "3.2.7-1ubuntu0.1+esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-27474",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-27474",
      "provider_updated_at": "2026-05-20T16:24:51.820671604Z"
    },
    {
      "name": "spip",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "3.2.11-3",
        "3.2.12-1",
        "4.0.2-1",
        "4.0.4-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-27474",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-27474",
      "provider_updated_at": "2026-05-20T16:24:51.820671604Z"
    },
    {
      "name": "spip",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "4.1.11+dfsg-1",
        "4.1.12+dfsg-1",
        "4.1.13+dfsg-1",
        "4.1.15+dfsg-1",
        "4.2.9+dfsg-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-27474",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-27474",
      "provider_updated_at": "2026-05-20T16:24:51.820671604Z"
    },
    {
      "name": "spip",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "4.3.8+dfsg-1",
        "4.4.3+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-27474",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-27474",
      "provider_updated_at": "2026-05-20T16:24:51.820671604Z"
    },
    {
      "name": "spip",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "4.4.3+dfsg-1",
        "4.4.6+dfsg-1",
        "4.4.7+dfsg-1",
        "4.4.8+dfsg-1",
        "4.4.9+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-27474",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-27474",
      "provider_updated_at": "2026-05-20T16:24:51.820671604Z"
    }
  ]
}

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 13 (Trixie)]

  • [spip]Inconnu
    Détails (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Corrigée · Corrigée: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

Observé:

Références

[FIRST EPSS] · [OSV Package Vulnerability Database]