CVE-2026-22205SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling

Descripción

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html vendor-advisorypatchRelease Notes
• https://git.spip.net/spip/spip productProduct
• https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags relatedThird Party Advisory