CVE-2026-22205SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling

Beschreibung

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html vendor-advisorypatchRelease Notes
• https://git.spip.net/spip/spip productProduct
• https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags relatedThird Party Advisory