CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_expo

SPIP SPIP

CVSS

9.8Critical

ExploitationPublic exploit codeExploit module, 20 Aug 2026. Not in the KEV catalogMetasploit

Exploit odds (EPSS)2.29%Chance of exploitation activity in the next 30 days, higher than 83% of CVEs. Scored 27 Oct 2026FIRST EPSS

Fixed in4.4.20Fixed versionCVE List

Published20 Aug 2026Updated 21 Aug 2026CVE List

What fixes it

4.4.20SPIPCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

20 Aug 2026Exploit code publicMetasploit
20 Aug 2026, 22:24 UTCPublishedCVE List

Public exploit code and templates 1

Exploit moduleSPIP X-Spip-Filtre Unauthenticated RCE 20 Aug 2026Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

piecar21/CVE-2026-77647: PoC / exploit archive for CVE-2026-77647GitHub proof-of-concept repositories, 27 Oct 2026Exploit code

Description

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

Text from CVE List

Affected versions 1

SPIPaffected: all versions before 4.4.20CVE List