CVE-2026-77806CWE-94code-injection

CVE-2026-77806

Critical · published August 21, 2026

CVSS v3.1
9.8
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04479 · 91.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-21T18:16Z
References (4)
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html · [email protected]https://github.com/rapid7/metasploit-framework/pull/21790 · [email protected]https://github.com/rapid7/metasploit-framework/pull/21790#issuecomment-5368038123 · [email protected]https://github.com/rapid7/metasploit-framework/pull/21790/commits/b16eca819abb8f1401f21d115e71e3dfc67b847c · [email protected]
EPSS history
Timeline
  • 21 AUG 13:37Z
    SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026
    cvelistv5