01 Record

CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and

CriticalPUBLISHEDCNA: mitre

Base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON CVE Program record

02 Description

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and

03 Metadata

Published

2026-08-20 22:24Z1 DAY AGO

Last updated

2026-08-21 20:08Z5 HR AGO

Reserved

2026-08-20

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94Improper Control of Generation of Code ('Code Injection')Base

SSVC decision

ExploitationnoneAutomatableyesTechnical Impacttotal

Data version

5.2

Document digest

4c0a960cf8e83fda98c06f06f87583423e9bb7fc2be882082c65a04518890d79

04 Affected products

VendorProductVersionsPlatforms

SPIPSPIP0 to < 4.4.20—

05 References

blog.spip.nethttps://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-20.htmlvendor-advisory
lists.debian.orghttps://lists.debian.org/debian-security-announce/2026/msg00359.htmlthird-party-advisory