CVE-2026-77647CWE-94code-injection

CVE-2026-77647

Critical · published August 21, 2026

CVSS v3.1
9.8
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02292 · 83.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-21T03:16Z
References (2)
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-20.html · [email protected]https://lists.debian.org/debian-security-announce/2026/msg00359.html · [email protected]
EPSS history
Timeline
  • 20 AUG 22:24Z
    SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026
    cvelistv5