CVE-2026-77806: SPIP Code Injection RCE Vulnerability

CVE-2026-77806 Overview

CVE-2026-77806 is a code injection vulnerability in SPIP, an open-source content management system, affecting versions before 4.4.21. Unauthenticated remote attackers can execute arbitrary code by sending a crafted X-Spip-Filtre HTTP request header. The SPIP function analyse_resultat_skel mishandles the header value, leading to arbitrary code execution on the underlying web server. The flaw is classified as [CWE-94] Improper Control of Generation of Code. Public exploitation activity has been reported in August 2026, and a Metasploit module is in development.

Critical Impact
Unauthenticated network attackers can achieve remote code execution on any SPIP instance older than 4.4.21 by sending a single HTTP request.

Affected Products

SPIP versions prior to 4.4.21
SPIP web deployments exposing the front-end HTTP interface
Sites relying on the analyse_resultat_skel template processing pipeline

Discovery Timeline

2026-08-21 - CVE-2026-77806 published to the National Vulnerability Database (NVD)
2026-08-21 - Last updated in NVD database
August 2026 - Exploitation reported in the wild per the NVD description

Technical Details for CVE-2026-77806

Vulnerability Analysis

The vulnerability resides in SPIP's template result analysis function analyse_resultat_skel. SPIP accepts a client-supplied HTTP header named X-Spip-Filtre that is used to influence server-side filter processing. The header value is inserted into a code evaluation path without sufficient sanitization, allowing an attacker to inject PHP code that the interpreter subsequently executes.

Because the attack surface is the HTTP request pipeline, exploitation requires no authentication, no user interaction, and no prior knowledge of the target. Any internet-reachable SPIP endpoint before version 4.4.21 is exposed. Successful exploitation yields code execution in the context of the PHP process, typically the web server user, enabling webshell installation, data theft, lateral movement, and persistence.

Root Cause

The root cause is improper neutralization of user-controlled input used in a dynamic code generation context [CWE-94]. The analyse_resultat_skel routine treats the X-Spip-Filtre header as trusted filter directives and passes it into an evaluation path where PHP semantics apply.

Attack Vector

Exploitation is performed over the network by issuing an HTTP request to any SPIP-rendered endpoint. The attacker sets the X-Spip-Filtre header to a payload that terminates the expected filter expression and appends PHP code. When SPIP processes the response skeleton, the injected code is evaluated server-side.

See the SPIP Security Update Announcement and the Metasploit PR #21790 for exploit development details.

Detection Methods for CVE-2026-77806

Indicators of Compromise

HTTP requests containing the X-Spip-Filtre header, especially with values containing PHP tokens such as system(, passthru(, eval(, backticks, or base64-encoded strings.
New or modified PHP files in SPIP directories such as tmp/, IMG/, local/, or squelettes/ following suspicious HTTP traffic.
Outbound connections initiated by the web server process (php-fpm, apache2, nginx worker) to unexpected hosts after receipt of X-Spip-Filtre requests.
Web server processes spawning shell interpreters (sh, bash, python) or reconnaissance commands (id, uname, whoami).

Detection Strategies

Deploy Web Application Firewall (WAF) rules that block or alert on any inbound HTTP request containing the X-Spip-Filtre header, as legitimate clients do not send it.
Hunt in HTTP access and proxy logs for the header name across historical data to identify pre-patch exploitation attempts.
Correlate web server child process creation with the receiving request identifier to detect command execution originating from a template render.

Monitoring Recommendations

Enable full HTTP header logging on reverse proxies fronting SPIP so header-based payloads are captured and searchable.
Monitor file integrity on SPIP installation directories and alert on new PHP files or modifications outside deployment windows.
Baseline outbound network activity from web servers and alert on deviations consistent with reverse-shell or downloader behavior.

How to Mitigate CVE-2026-77806

Immediate Actions Required

Upgrade all SPIP installations to version 4.4.21 or later without delay.
Inventory internet-exposed SPIP instances and prioritize public-facing hosts.
Review web server, application, and access logs for X-Spip-Filtre occurrences going back to at least July 2026 and treat matching hosts as potentially compromised.
Rotate credentials, API keys, and secrets accessible to the web server if exploitation is suspected.

Patch Information

The SPIP project released version 4.4.21 addressing the code injection in analyse_resultat_skel. Refer to the SPIP Security Update Announcement for release notes and upgrade instructions.

Workarounds

Configure the fronting reverse proxy or WAF to strip or reject inbound X-Spip-Filtre headers until patching is complete.
Restrict administrative and public SPIP endpoints behind network-level access controls where feasible.
Run PHP under a least-privilege service account with restricted filesystem write permissions to limit post-exploitation impact.

bash

# Nginx: drop the X-Spip-Filtre header before it reaches SPIP
proxy_set_header X-Spip-Filtre "";

# Apache (mod_headers): remove the header from inbound requests
RequestHeader unset X-Spip-Filtre