{"id":"CVE-2026-77647","aliases":["DEBIAN-CVE-2026-77647","EUVD-2026-63757","GHSA-wj6g-rh9q-6vvm","UBUNTU-CVE-2026-77647"],"status":"published","title":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02292,"percentile":0.83466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2026-08-20T22:24:39Z","modified":"2026-10-27T09:47:39Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/spip_x_spip_filtre_rce","title":"SPIP X-Spip-Filtre Unauthenticated RCE","type":"exploit","platform":"Linux,Unix","date":"2026-08-20","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/spip_x_spip_filtre_rce"},{"source":"pocgithub","id":"Nxploited/CVE-2026-77647","title":"Nxploited/CVE-2026-77647","date":"2026-10-26","url":"https://github.com/Nxploited/CVE-2026-77647"}],"fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["4.4.20+dfsg-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["4.4.20+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.20+dfsg-0+deb13u1"}]}],"versions":["4.4.10+dfsg-1","4.4.11+dfsg-0+deb13u1","4.4.11+dfsg-1","4.4.13+dfsg-0+deb13u1","4.4.13+dfsg-1","4.4.14+dfsg-1","4.4.15+dfsg-0+deb13u1","4.4.15+dfsg-1","4.4.16+dfsg-0+deb13u1","4.4.16+dfsg-1","4.4.18+dfsg-1","4.4.19+dfsg-0+deb13u1","4.4.19+dfsg-1","4.4.3+dfsg-1","4.4.3+dfsg-1+deb13u1","4.4.4+dfsg-1","4.4.5+dfsg-1","4.4.6+dfsg-1","4.4.7+dfsg-1","4.4.8+dfsg-1","4.4.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.20+dfsg-1"}]}],"versions":["4.4.10+dfsg-1","4.4.11+dfsg-1","4.4.13+dfsg-1","4.4.14+dfsg-1","4.4.15+dfsg-1","4.4.16+dfsg-1","4.4.18+dfsg-1","4.4.19+dfsg-1","4.4.3+dfsg-1","4.4.4+dfsg-1","4.4.5+dfsg-1","4.4.6+dfsg-1","4.4.7+dfsg-1","4.4.8+dfsg-1","4.4.9+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1","3.1.4-4~deb9u5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1","3.2.7-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-3","3.2.12-1","4.0.2-1","4.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.11+dfsg-1","4.1.12+dfsg-1","4.1.13+dfsg-1","4.1.15+dfsg-1","4.2.9+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3+dfsg-1","4.4.6+dfsg-1","4.4.7+dfsg-1","4.4.8+dfsg-1","4.4.9+dfsg-1"]}],"products":[{"vendor":"spip","product":"spip"}],"references":[{"url":"https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-20.html","tags":["vendor-advisory","report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00359.html","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77647"},{"url":"https://github.com/advisories/GHSA-wj6g-rh9q-6vvm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77647","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-77647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77647","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-77647","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","status":"published","published":"2026-08-20T22:24:39.626Z","modified":"2026-08-21T20:08:38.061Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:16.072351Z"}],"euvd":[{"id":"EUVD-2026-63757","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","status":"published","published":"2026-08-20T22:24:39Z","modified":"2026-08-21T20:08:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:36.844009Z"}],"ghsa":[{"id":"GHSA-wj6g-rh9q-6vvm","title":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","status":"published","published":"2026-08-21T00:31:24Z","modified":"2026-08-21T00:31:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:10:48.883791Z"}],"nvd":[{"id":"CVE-2026-77647","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","status":"published","published":"2026-08-20T23:16:28.647Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"DEBIAN-CVE-2026-77647","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","status":"published","published":"2026-08-20T23:16:28.647Z","modified":"2026-10-27T09:47:39.580855744Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"UBUNTU-CVE-2026-77647","description":"SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of \u003c?php blocks, and var_export's mishandling of certain cases such as presence of a '\u003c' character.","status":"published","published":"2026-08-20T23:16:00Z","modified":"2026-09-02T19:36:34.847127209Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:18.015985Z"}]}}