Vulnerabilities

CVSS

9.8 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk score

78.4

Published

2026-08-21

Status

Received

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

Weaknesses

CWE-94

Coverage 1

vulnerability

Vulnérabilité dans SPIP (21 août 2026)

A remote code execution vulnerability has been discovered in SPIP, allowing attackers to execute arbitrary code from a remote location. The vulnerability is currently being actively exploited, and users of SPIP versions…

CERT-FR · Aug 21, 2026 High

CVE-2026-77806remote-code-executionvulnerabilitysecurity

All articles mentioning it

Advisories and references

• blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21...
• github.com/rapid7/metasploit-framework/pull/21790
• github.com/rapid7/metasploit-framework/pull/21790#issuecomment-53680...
• github.com/rapid7/metasploit-framework/pull/21790/commits/b16eca819a...