p PatchFirst

CVE-2026-8430

CVE-2026-8430 · SPIP < 4.4.14 Remote Code Execution via nginx

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx configuration scenarios to achieve code execution, and this issue is not mitigated by the SPIP security screen.

CVSS 9.2 · Critical · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • spip

    Versions
    • ≥ 0, < 4.4.14: Affected (semver)

    Update to 4.4.14

  • spip Debian:13

    Versions
    • 4.4.10+dfsg-1
    • 4.4.11+dfsg-0+deb13u1
    • 4.4.11+dfsg-1
    • 4.4.13+dfsg-0+deb13u1
    • 4.4.13+dfsg-1
    • 4.4.14+dfsg-1
    • 4.4.3+dfsg-1
    • 4.4.3+dfsg-1+deb13u1
    • 4.4.4+dfsg-1
    • 4.4.5+dfsg-1
    • 4.4.6+dfsg-1
    • 4.4.7+dfsg-1
    • 4.4.8+dfsg-1
    • 4.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 4.4.15+dfsg-0+deb13u1

    Update to 4.4.15+dfsg-0+deb13u1

  • spip Debian:14

    Versions
    • 4.4.10+dfsg-1
    • 4.4.11+dfsg-1
    • 4.4.13+dfsg-1
    • 4.4.3+dfsg-1
    • 4.4.4+dfsg-1
    • 4.4.5+dfsg-1
    • 4.4.6+dfsg-1
    • 4.4.7+dfsg-1
    • 4.4.8+dfsg-1
    • 4.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 4.4.14+dfsg-1

    Update to 4.4.14+dfsg-1

  • spip Ubuntu:Pro:16.04:LTS

    Versions
    • 3.0.20-1
    • 3.0.21-1
    • 3.0.21-1ubuntu1
    • 3.0.21-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:Pro:18.04:LTS

    Versions
    • 3.1.4-3
    • 3.1.4-4~deb9u3build0.18.04.1
    • 3.1.4-4~deb9u5build0.18.04.1
    • 3.1.4-4~deb9u5ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:Pro:20.04:LTS

    Versions
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.7-1
    • 3.2.7-1ubuntu0.1
    • 3.2.7-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:22.04:LTS

    Versions
    • 3.2.11-3
    • 3.2.12-1
    • 4.0.2-1
    • 4.0.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:24.04:LTS

    Versions
    • 4.1.11+dfsg-1
    • 4.1.12+dfsg-1
    • 4.1.13+dfsg-1
    • 4.1.15+dfsg-1
    • 4.2.9+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:25.10

    Versions
    • 4.3.8+dfsg-1
    • 4.4.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:26.10

    Versions
    • 4.4.9+dfsg-1
    • 4.4.15+dfsg-1
    • 4.4.16+dfsg-1
    • 4.4.19+dfsg-1
    • 4.4.20+dfsg-1
    • 4.4.21+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • spip Ubuntu:26.04:LTS

    Versions
    • 4.4.3+dfsg-1
    • 4.4.6+dfsg-1
    • 4.4.7+dfsg-1
    • 4.4.8+dfsg-1
    • 4.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →