Quick answers
- Is CVE-2026-77806 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77806 being exploited in the wild.
- How severe is CVE-2026-77806?
- Critical severity, with a CVSS score of 9.8, published 21 August 2026.
- Which products and versions are affected?
- Spip before 4.4.21.
- Is there a fix for CVE-2026-77806?
- A patch was published on 2026-08-20: SPIP 4.4.21 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77806 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-77806?
- Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a code injection flaw in the analyse_resultat_skel function that improperly handles the X-Spip-Filtre HTTP request header without sufficient validation or sanitization. An unauthenticated remote attacker can craft a malicious HTTP request with a specially crafted X-Spip-Filtre header value to inject and execute arbitrary PHP code on the affected server. The vulnerability requires no authentication, user interaction, or special preconditions—it is universally exploitable against vulnerable versions. The vulnerability affects SPIP versions prior to 4.4.21, which introduced fixes to properly validate and restrict header processing. A Metasploit module was developed shortly after disclosure, facilitating widespread exploitation.
Affected products
- SPIP SPIP before 4.4.21
Timeline
- 2026-08-21: disclosed
- 2026-08: exploited: Active exploitation attempts detected in the wild
- 2026-08-20: patched: SPIP 4.4.21 released with fix