🚨 Critical Vulnerability Alert: CVE-2026–77806 — SPIP Unauthenticated RCE Explained

Content Management Systems power a vast portion of the modern web, making core framework vulnerabilities particularly high-stakes. A critical security flaw identified as CVE-2026–77806 (CVSS 9.8) has recently surfaced in the widely used SPIP publishing system, affecting all versions prior to 4.4.21. This flaw enables remote, unauthenticated attackers to execute arbitrary system commands on target servers with zero administrative privileges required.

The Mechanism Behind the Exploit

At its core, the vulnerability resides within SPIP's dynamic template rendering engine, specifically inside the analyse_resultat_skel function. During normal skeleton template compilation, SPIP allows dynamic filter functions to sanitize or format data. However, the engine improperly trusts client-supplied HTTP request headers—most notably X-Spip-Filtre.

When an unauthenticated HTTP request hits a template-rendering endpoint (such as public forum or comment preview pages), SPIP extracts the untrusted header string and appends it directly into the generated dynamic PHP code array. Because input sanitization and strict function allowlists are missing, standard command execution primitives (like passthru, system, or exec) run directly under the security context of the web server daemon (www-data).

Even worse, standard built-in security defenses, such as SPIP's écran de sécurité, fail to block this vector out of the box because the payload relies on HTTP headers rather than conventional GET/POST parameters.

Remediation & Defense

Security teams operating SPIP infrastructure should act immediately:

• Upgrade to SPIP 4.4.21+ to patch the underlying template compilation logic.
• Deploy WAF/Reverse Proxy Rules on Nginx or Apache to drop incoming requests containing the X-Spip-Filtre header.
• Audit Access Logs for anomalous header strings targeting dynamic template endpoints.

📖 Read the Full Technical Breakdown & PoC

For complete source code analysis, attack flow diagrams, execution payloads, and web server log samples, read the full article on my blog:

👉 Read the Full Analysis on Deniz Halil's Blog