CVE-2026-77806
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Fi…
Published: 2026-08-21 · CVSS: 9.8 · CVSS 3.1
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7