CVE-2026-77806
Quick assessment
Affected
SPIP SPIP
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SPIP是法国SPIP组织开源的一套内容管理系统。 SPIP 4.4.21之前版本存在代码注入漏洞，该漏洞源于X-Spip-Filtre HTTP请求标头被analyse_resultat_skel错误处理，可能导致未经身份验证的远程攻击者执行任意代码。
Public Exploits 1
Nuclei · 1
CVE-2026-77806.yaml [template]
In-the-Wild Activity Observed
github_trending · low
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77806
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
SPIP 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SPIP是法国SPIP组织开源的一套内容管理系统。 SPIP 4.4.21之前版本存在代码注入漏洞，该漏洞源于X-Spip-Filtre HTTP请求标头被analyse_resultat_skel错误处理，可能导致未经身份验证的远程攻击者执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-77806
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | SPIP < 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-77806.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77806
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-77806 (3)
Security Blog Posts for CVE-2026-77806 (1)
IV. Related Vulnerabilities
Same product: SPIP
-
CVE-2026-109378
SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url -
CVE-2026-72710
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection -
CVE-2026-72709
SPIP < 4.4.18 Missing Authorization via ecrire/action/ -
CVE-2026-72708
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitema -
CVE-2026-77647
SPIP 代码注入漏洞
Same vendor: SPIP
-
CVE-2026-109378
SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url -
CVE-2026-104070
SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE -
CVE-2026-72710
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection -
CVE-2026-72709
SPIP < 4.4.18 Missing Authorization via ecrire/action/ -
CVE-2026-72708
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitema
Same weakness: CWE-94
-
CVE-2026-54566
Markdown Preview Enhanced: Remote Code Execution via VM Sand -
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-108151
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vu -
CVE-2026-103081
WordPress Salevo plugin <= 1.3.0 - Content Injection vulnera -
CVE-2026-0322
PAN-OS: Authenticated Remote Code Execution (RCE) in the Man
V. Comments for CVE-2026-77806
No comments yet