/Vulnerability Library

SPIP < 4.4.22 - Unauthenticated RCE

CVE-2026-77806
Verified

Description

SPIP < 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Published Date

August 25, 2026

Template Author

0x_akoko

CVE-2026-77806.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-77806
CWE ID:
cwe-94

References

https://securityonline.info/cve-2026-77806-spip-unauthenticated-rce/https://blog.spip.net/

Remediation Steps

Update to version 4.4.21 or later.