Executive brief
SPIP is a free, open-source content management system used to build and manage websites. The vulnerability allows unauthenticated attackers to execute arbitrary code remotely by injecting malicious code through an HTTP request header, without requiring login credentials or any legitimate access. Active exploitation attempts were detected in the wild shortly after the vulnerability became known, making immediate patching critical.
Technical details
The vulnerability is a code injection flaw in the analyse_resultat_skel function that improperly handles the X-Spip-Filtre HTTP request header without sufficient validation or sanitization. An unauthenticated remote attacker can craft a malicious HTTP request with a specially crafted X-Spip-Filtre header value to inject and execute arbitrary PHP code on the affected server. The vulnerability requires no authentication, user interaction, or special preconditions—it is universally exploitable against vulnerable versions. The vulnerability affects SPIP versions prior to 4.4.21, which introduced fixes to properly validate and restrict header processing. A Metasploit module was developed shortly after disclosure, facilitating widespread exploitation.
Affected products
- SPIP SPIP before 4.4.21
Timeline
- 2026-08-21: disclosed
- 2026-08: exploited: Active exploitation attempts detected in the wild
- 2026-08-20: patched: SPIP 4.4.21 released with fix