High
spip — security advisory
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.
- Products
- spip
- Affected versions
- 3.0.20-1, 3.0.21-1, 3.0.21-1ubuntu1, 3.0.21-1ubuntu1+esm1, 3.1.4-3, 3.1.4-4~deb9u3build0.18.04.1, 3.1.4-4~deb9u5build0.18.04.1, 3.1.4-4~deb9u5ubuntu0.1~esm2, 3.2.11-3, 3.2.12-1, 3.2.4-1, 3.2.5-1, 3.2.7-1, 3.2.7-1ubuntu0.1, 3.2.7-1ubuntu0.1+esm2, 4.0.2-1, 4.0.4-1, 4.1.11+dfsg-1, 4.1.12+dfsg-1, 4.1.13+dfsg-1, 4.1.15+dfsg-1, 4.2.9+dfsg-2, 4.3.8+dfsg-1, 4.4.15+dfsg-1, 4.4.16+dfsg-1, 4.4.19+dfsg-1, 4.4.20+dfsg-1, 4.4.21+dfsg-1, 4.4.3+dfsg-1, 4.4.6+dfsg-1, 4.4.7+dfsg-1, 4.4.8+dfsg-1, 4.4.9+dfsg-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-8429
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:23 UTC · Revision 1
Source evidence
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.
osv:UBUNTU-CVE-2026-8429
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
spip
Fixed versions: Not specified
Complete source record
{
"id": "014c68d64cc68d6c449ac7bf6d2a285451b0f118cd7f2addcfa22460be8fc4ef",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-8429",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-8429",
"summary": "SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses the SPIP security screen protections.",
"evidence": "osv:UBUNTU-CVE-2026-8429",
"products": [
{
"name": {
"value": "spip",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.20-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.21-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.21-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.21-1ubuntu1+esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.4-3",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.4-4~deb9u3build0.18.04.1",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.4-4~deb9u5build0.18.04.1",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.4-4~deb9u5ubuntu0.1~esm2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.2.4-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.2.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.2.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.2.7-1ubuntu0.1",
"evidence": "/affected/2/versions"
},
{
"value": "3.2.7-1ubuntu0.1+esm2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.2.11-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.2.12-1",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.4-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.1.11+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.1.12+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.1.13+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.1.15+dfsg-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.2.9+dfsg-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.8+dfsg-1",
"evidence": "/affected/5/versions"
},
{
"value": "4.4.3+dfsg-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.4.9+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "4.4.15+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "4.4.16+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "4.4.19+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "4.4.20+dfsg-1",
"evidence": "/affected/6/versions"
},
{
"value": "4.4.21+dfsg-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "spip",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.4.3+dfsg-1",
"evidence": "/affected/7/versions"
},
{
"value": "4.4.6+dfsg-1",
"evidence": "/affected/7/versions"
},
{
"value": "4.4.7+dfsg-1",
"evidence": "/affected/7/versions"
},
{
"value": "4.4.8+dfsg-1",
"evidence": "/affected/7/versions"
},
{
"value": "4.4.9+dfsg-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-8429",
"aliases": [
"UBUNTU-CVE-2026-8429"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"3.0.20-1",
"3.0.21-1",
"3.0.21-1ubuntu1",
"3.0.21-1ubuntu1+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "3.0.21-1ubuntu1+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"3.1.4-3",
"3.1.4-4~deb9u3build0.18.04.1",
"3.1.4-4~deb9u5build0.18.04.1",
"3.1.4-4~deb9u5ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "3.1.4-4~deb9u5ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"3.2.4-1",
"3.2.5-1",
"3.2.7-1",
"3.2.7-1ubuntu0.1",
"3.2.7-1ubuntu0.1+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "3.2.7-1ubuntu0.1+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"3.2.11-3",
"3.2.12-1",
"4.0.2-1",
"4.0.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "4.0.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"4.1.11+dfsg-1",
"4.1.12+dfsg-1",
"4.1.13+dfsg-1",
"4.1.15+dfsg-1",
"4.2.9+dfsg-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "4.2.9+dfsg-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"4.3.8+dfsg-1",
"4.4.3+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "4.4.3+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"4.4.9+dfsg-1",
"4.4.15+dfsg-1",
"4.4.16+dfsg-1",
"4.4.19+dfsg-1",
"4.4.20+dfsg-1",
"4.4.21+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "4.4.21+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "spip",
"purl": "pkg:deb/ubuntu/spip?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"4.4.3+dfsg-1",
"4.4.6+dfsg-1",
"4.4.7+dfsg-1",
"4.4.8+dfsg-1",
"4.4.9+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-8429.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "spip",
"binary_version": "4.4.9+dfsg-1"
}
]
}
}
],
"modified": "2026-10-17T13:01:12.302534026Z",
"provider": "osv",
"upstream": [
"CVE-2026-8429"
],
"references": [
"https://ubuntu.com/security/CVE-2026-8429",
"https://www.cve.org/CVERecord?id=CVE-2026-8429"
]
},
"related_cves": [
{
"value": "CVE-2026-8429",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361249,
"published_at": "2026-05-12T19:16:00+00:00"
}