CVE-2026-77647
CriticalCVSS 9.8Summary
SPIP before version 4.4.20 contains a vulnerability allowing unauthenticated remote attackers to execute arbitrary code. The issue is related to incorrect identification of <?php blocks and var_export's mishandling of certain cases such as the presence of a '<' character. This vulnerability was exploited in the wild in August 2026.
Risk Assessment
An unauthenticated attacker can take over the server, potentially leading to full system compromise, data theft, or further network attacks.
Recommendation
Immediately update SPIP to version 4.4.20 or later to remediate the vulnerability.
Original NVD description (English source)
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.