SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-77806

CRITICAL · CVSS 9.8 EPSS 4.20% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-21 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

SPIP versions prior to 4.4.21 are vulnerable to unauthenticated remote code execution due to improper handling of the X-Spip-Filtre HTTP request header, allowing attackers to inject malicious code. This critical vulnerability has been actively exploited in the wild, posing significant risks to any installations of SPIP. Organizations using SPIP should prioritize immediate updates to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗
External Security References
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-77806
Severity
CRITICAL
CVSS
9.8
EPSS
4.20%

Original NVD Description

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.