SPIP < 4.4.22 - Unauthenticated RCE

SPIP 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyseresultatskel, letting unauthenticated remote attackers execute arbitrary code. id: CVE-2026-77806 info: name: SPIP 4.4.22 - Unauthenticated RCE author: 0xAkoko severity: critical...

The vulnerability of the analyse_resultat_skel() function in the SPIP content management system allows a hacker to execute arbitrary code.

The vulnerability of the analyseresultatskel function in the SPIP content management system is related to improper handling of code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-77806: Improper Control of Generation of Code

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...