Do Son 
TL;DR
CVE-2026-77647 is a CVSS 9.8 unauthenticated remote code execution flaw in the SPIP CMS. It affects all versions before 4.4.20. Attackers are already exploiting it in the wild, so patching is urgent.
- CVE: CVE-2026-77647
- CVSS: 9.8 (Critical · CVSSv3)
- Product: SPIP
- Affected: < 4.4.20
- Impact: SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...
- Status: Exploited in the wild
- Patched in: 4.4.20
- Action: Update to 4.4.20 now
Why This SPIP Flaw Matters
SPIP powers many websites, especially across French-speaking organizations. As a result, a network-reachable RCE puts a large footprint at risk. This bug needs no login. An unauthenticated remote attacker can run arbitrary code on the server. The SPIP team calls the release a critical security update in its official advisory.
How the Attack Works
The root cause sits in how SPIP handles code blocks. Per the advisory, the flaw ties to “incorrect identification of <?php blocks.” It also involves var_export mishandling certain inputs, such as a stray “<” character. Together, these gaps let crafted input reach code execution. No login step stands in the way.
Exploitation Status
This vulnerability is not theoretical. The advisory states attempts to exploit it “have already been observed in the wild.” Public CVE trackers echo that the flaw was exploited in August 2026. Therefore defenders should treat it as an active threat.
Affected Versions
The flaw affects all SPIP releases before 4.4.20. Version 4.4.20 contains the fix. It also ships several unrelated bug fixes for caching and image handling.
Patch and Mitigation Steps
Update to SPIP 4.4.20 as fast as possible. You can upgrade with the latest spip_loader, version 7.0.0. The tool is available from the official SPIP distribution site. There is no reliable workaround, so patching is the only safe path.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
