{"schema":"threatline.record/2","record":{"id":"CVE-2026-77647","aliases":[],"summary":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_expo","details":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.","categories":["Unclassified"],"product":"SPIP","vendor":"SPIP","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77647","source_modified_at":"2026-08-21T20:08:38.061Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"SPIP","vendor":"SPIP","versions":[{"lessThan":"4.4.20","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77647","source_modified_at":"2026-08-21T20:08:38.061Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"SPIP","ecosystem":null},"version":"4.4.20","basis":"first unaffected version stated in the CVE record"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.02292,"percentile":0.83142,"score_date":"2026-10-27"},"published_at":"2026-08-20T22:24:39.626Z","modified_at":"2026-08-21T20:08:38.061Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77647","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-08-21T20:08:38.061Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_x_spip_filtre_rce.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-08-20"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77647","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["CVE List","Metasploit","EPSS"],"references":[{"source":"CVE List","url":"https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-20.html","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://lists.debian.org/debian-security-announce/2026/msg00359.html","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-08-21T19:49:42.530562Z"},"exploits":[{"added":"2026-08-17","check":true,"date":"2026-08-20","kind":"Exploit module","name":"SPIP X-Spip-Filtre Unauthenticated RCE","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_x_spip_filtre_rce.rb"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-08-21T20:08:38.061Z","content_hash":"ed36a438e174c5ff366e617b21a21819f330bd8a7ea5c453c46a1964d161c8b4"}}