CVE Catalog
CVE-2026-77806
CriticalCVSS 9.8Summary
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
Risk Assessment
An unauthenticated attacker can execute arbitrary code on the server, potentially leading to full system compromise and data breach.
Recommendation
Immediately upgrade SPIP to version 4.4.21 or later.
Original NVD description (English source)
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.