CVE-2026-77806: Code Injection
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
SPIP installations running versions before 4.4.21 are exposed. Exploitation is remote and does not require authentication or user interaction.
What does an attacker need to exploit it?
An attacker only needs network access to a reachable SPIP instance and can send a crafted HTTP request using the X-Spip-Filtre header. No privileges are required.
How serious is successful exploitation?
Successful exploitation allows arbitrary code execution, with high impact to confidentiality, integrity, and availability. The vulnerability has been exploited in the wild in August 2026.
How can I determine whether an instance is affected?
Check the installed SPIP version. Versions earlier than 4.4.21 are affected.