Vulnerability Description
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.htm
- https://github.com/rapid7/metasploit-framework/pull/21790
- https://github.com/rapid7/metasploit-framework/pull/21790#issuecomment-536803812
- https://github.com/rapid7/metasploit-framework/pull/21790/commits/b16eca819abb8f
FAQ
What is CVE-2026-77806?
CVE-2026-77806 is a vulnerability with a CVSS score of 9.8 (CRITICAL). SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request heade...
How severe is CVE-2026-77806?
CVE-2026-77806 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-77806?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.