The flaw exists in SPIP versions older than 4.4.9, where the public area accepts serialized payloads through the table_valeur filter and the DATA iterator. This insecure deserialization can trigger arbitrary PHP object instantiation and, because the attacker can control the serialized content, result in code execution. The issue is aligned with CWE-502, Insecure Deserialization.

SPIP, the content‑management system. All releases dated before SPIP 4.4.9 are vulnerable. No version granular detail is given beyond the pre‑4.4.9 cutoff. The advisory lists SPIP as the sole CNA vendor/product.

The vulnerability scores a CVSS 9.2, indicating high severity. The EPSS is below 1 %, suggesting exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. However, an attacker must first place malicious serialized data, which typically requires some level of access to the public area or an additional vulnerability to write the payload. Once the payload is processed through the exposed filter or iterator, arbitrary object instantiation and code execution can be achieved. The public nature of the affected components lowers the barrier to interaction but still demands the payload injection pre‑condition.