CVE-2026-77647

Received Received - Intake

Remote Code Execution in SPIP CMS

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-77647

EUVD

EUVD-2026-63757

Affected Vendors & Products

Vendor	Product	Version / Range
spip	spip	to 4.4.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in SPIP before version 4.4.20 allows unauthenticated remote attackers to execute arbitrary code. The issue stems from incorrect identification of PHP code blocks and improper handling of certain characters by var_export, enabling attackers to inject and execute malicious code.

Impact Analysis

An attacker could exploit this to take full control of your SPIP installation, steal sensitive data, deface your website, or use it as a launchpad for further attacks. Since no authentication is required, any unpatched SPIP instance is at immediate risk.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade SPIP to version 4.4.20 or later to address the arbitrary code execution flaw. Remove or restrict access to vulnerable instances until patched. Monitor network traffic for unusual PHP execution patterns or unauthorized code injection attempts.

Hi! I’m here to help you understand CVE-2026-77647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70