CVE-2026-77647: Code Injection
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and varexport's mishandling of certain cases such as presence of a '<' character.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SPIP installations running a version before 4.4.20 are affected. The issue can be exploited remotely without authentication or user interaction.
What can an attacker achieve?
An unauthenticated remote attacker can execute arbitrary code on the affected SPIP installation. The reported impact includes complete compromise of confidentiality, integrity, and availability.
Is active exploitation known?
Yes. The issue was reported as exploited in the wild in August 2026.
What is the immediate remediation?
Update SPIP to version 4.4.20 or later. The provided information does not identify an alternative mitigation for installations that cannot be updated immediately.