CVE-2026-77806: SPIP Unauthenticated RCE Exploited in the Wild as Public Exploit Lands

TL;DR

CVE-2026-77806 is a CVSS 9.8 unauthenticated RCE in the SPIP CMS. It affects all versions before 4.4.21. The flaw is exploited in the wild, and full details plus public exploit code are now available. Patch without delay.

Why This SPIP Flaw Matters

SPIP powers many public websites, especially across French-speaking institutions. As a result, a network-reachable RCE puts a wide footprint at risk. This flaw needs no login. An unauthenticated attacker can run arbitrary code on the server. The SPIP team flags the release as a critical security update in its official advisory.

How the Attack Works

The flaw is a code injection issue. It stems from an HTTP request header named X-Spip-Filtre. SPIP mishandles that header inside the analyse_resultat_skel routine. As a result, attacker-supplied input can reach code execution. Because the trigger is a simple header, exploitation is straightforward for an unauthenticated attacker.

Exploitation and Public Exploit Status

This threat is active. The CVE record states the flaw is exploited in the wild in August 2026. Furthermore, public exploit code now exists. A module was added to the Metasploit framework, as shown in this public commit. That combination sharply raises the risk for exposed sites.

Affected Versions

The flaw affects all SPIP releases before 4.4.21. Version 4.4.21 contains the fix. It also ships several unrelated bug fixes for SQLite handling and header capture.

Patch and Mitigation Steps

Update to SPIP 4.4.21 as fast as possible. You can upgrade with the latest spip_loader, version 7.0.0. The tool is available from the official SPIP distribution site. No reliable workaround exists, so patching is the only safe path.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.