Spip Tickets vulnerabilities

CVE-2026-27744 [CRITICAL] CWE-94 CVE-2026-27744: The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vul The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment rendering (#ENV**), which disables SPIP output filtering. As