SPIP < 4.4.22 - Unauthenticated RCE

SPIP 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyseresultatskel, letting unauthenticated remote attackers execute arbitrary code. id: CVE-2026-77806 info: name: SPIP 4.4.22 - Unauthenticated RCE author: 0xAkoko severity: critical...

CVE-2026-77806

exp.py link instruction scan.py link...

CVE-2026-77806

creationtimestamp| type| source ---|---|--- 2026-08-21 14:18:33+00:00| seen| https://bsky.app/profile/suriq.io/post/3mtlxbv445k2m 2026-08-21 16:07:21+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtm5efvzfp2c 2026-08-21 16:59:21+00:00| seen|...

DEBIAN-CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

UBUNTU-CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...