01 Record

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request

CriticalPUBLISHEDCNA: mitre

Base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON CVE Program record

02 Description

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request

03 Metadata

Published

2026-08-21 13:37Z12 HR AGO

Last updated

2026-08-21 17:43Z7 HR AGO

Reserved

2026-08-21

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94Improper Control of Generation of Code ('Code Injection')Base

SSVC decision

ExploitationnoneAutomatableyesTechnical Impacttotal

Data version

5.2

Document digest

7e81cf5399bc2b82c9f967015b3454696710767c340b0e193855dbea06b2b992

04 Affected products

VendorProductVersionsPlatforms

SPIPSPIP0 to < 4.4.21—

05 References

01 Record