Vulnerability · Published May 12, 2026 · Assigned by VulnCheck
CVE-2026-8430SPIP < 4.4.14 Remote Code Execution via nginx
High 8.1
In plain English
A high-severity code injection in SPIP from SPIP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx configuration scenarios to achieve code execution, and this issue is not mitigated by the SPIP security screen.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | spip | 4.4.15+dfsg-0+deb13u1 | DEBIAN-CVE-2026-8430 |
| Debian:14 | spip | 4.4.14+dfsg-1 | DEBIAN-CVE-2026-8430 |
| Ubuntu:22.04:LTS | spip | no fix listed | UBUNTU-CVE-2026-8430 |
| Ubuntu:24.04:LTS | spip | no fix listed | UBUNTU-CVE-2026-8430 |
| Ubuntu:25.10 | spip | no fix listed | UBUNTU-CVE-2026-8430 |
| Ubuntu:26.04:LTS | spip | no fix listed | UBUNTU-CVE-2026-8430 |
| Ubuntu:26.10 | spip | no fix listed | UBUNTU-CVE-2026-8430 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://blog.spip.net/ vendor-advisory
- https://www.vulncheck.com/advisories/spip-prior-to-remote-code-execution-via-nginx third-party-advisory