CVE-2023-27372: SPIP public-area form deserialization leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network-exploitable unauthenticated RCE and extremely high EPSS score make this an urgent patching priority.

What it is

SPIP before 4.2.1 mishandles serialization of form values submitted in the public area, allowing untrusted data to be deserialized. This permits remote code execution without authentication. Fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

Impact

An unauthenticated attacker can execute arbitrary code on the server, leading to full compromise of the SPIP instance and potentially the underlying host.

Attack surface

Reachable over the network via public-area form submissions; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.99682 (99.95th percentile) and public exploit references exist on Packet Storm, indicating high likelihood of active exploitation.

What to do

• Upgrade SPIP to 4.2.1, 4.1.8, 4.0.10, or 3.2.18 immediately.
• Apply the vendor patches referenced in the SPIP Git commits.
• For Debian systems, apply DSA-5367.
• If immediate patching is not possible, restrict public-area form submissions or place the SPIP instance behind authentication/WAF rules.
• Monitor for unexpected outbound connections or process creation from the web server.

Detection

• Inspect web server logs for POST requests to public-area form endpoints with serialized payloads.
• Monitor for unusual child processes spawned by the web server (e.g., PHP spawning shells).
• Use file integrity monitoring on SPIP directories for unexpected file writes.
• Review network traffic for known exploit patterns targeting SPIP deserialization.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.