CVE-2026-77806: SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August

Description

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

Affected Products

References

• https://github.com/rapid7/metasploit-framework/pull/21790
• https://github.com/rapid7/metasploit-framework/pull/21790#issuecomment-5368038123
• https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html
• https://github.com/rapid7/metasploit-framework/pull/21790/commits/b16eca819abb8f1401f21d115e71e3dfc67b847c

Related News (1 articles)