CVE-2026-77806
Received Received - Intake

Code Injection in SPIP via X-Spip-Filtre Header

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: MITRE

Description
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77806
EUVD
EUVD-2026-63948

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
spip spip to 4.4.21 (exc)
spip spip 4.4.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77806 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in SPIP, a content management system. It allows attackers to execute arbitrary code remotely without authentication by injecting malicious PHP code via an X-Spip-Filtre HTTP request header. The flaw exists in the template engine's analyse_resultat_skel() function, which mishandles user-controlled input.

Detection Guidance

Check if your SPIP instance is running version 4.4.20 or earlier. Look for suspicious HTTP requests containing X-Spip-Filtre headers or newline characters in forum preview fields. Use network monitoring tools to detect unauthorized code execution attempts.

Impact Analysis

This vulnerability allows attackers to take full control of a vulnerable SPIP server, execute arbitrary commands, and potentially gain remote shell access. Since it requires no authentication, any unpatched SPIP instance (version 4.4.20 or earlier) is at risk. Attackers could steal data, deface websites, or use the server for further attacks.

Compliance Impact

This RCE vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information. Organizations must patch immediately to avoid compliance violations and potential fines.

Mitigation Strategies

Upgrade SPIP to version 4.4.21 immediately using the spip_loader script from https://get.spip.net/. If custom installation is required, apply the patch manually. Ensure PHP versions between 7.4 and 8.5 are supported. Monitor for exploitation attempts post-upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart