Paper/Archive/CVE-2026-77806

CVE-2026-77806

SPIP SPIP — SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.

EPSS 4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 91.5.915 × 2018.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

Affected

ProductAffectedFixed inSource

SPIP< 4.4.214.4.21CNA

Scores by source

mitre (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/rapid7/metasploit-framework/pull/21790 refgithub.com/rapid7/metasploit-framework/pull/21790#issuecomment-5368038123 refblog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html refgithub.com/rapid7/metasploit-framework/pull/21790/commits/b16eca819abb8f1401f21d115e71e3dfc67b847c