SPIP Patched a Pre-Auth RCE. The First Fix Was Still Vulnerable.
SPIP told administrators to install an emergency security release for a pre-authentication remote code execution flaw. Three days later, it released another emergency update because the first fix was still vulnerable.
Sites running the French open-source publishing platform should be on SPIP 4.4.21 or later. The final advisory says attackers were already attempting to exploit the flaw, and public exploit code is available. The vendor also says its optional security screen does not block the attack.
The most urgent issue is CVE-2026-77806, a critical code-injection vulnerability that lets a remote unauthenticated attacker execute arbitrary code by sending a crafted X-Spip-Filtre HTTP header. It affects every SPIP release before 4.4.21.
The first emergency release did not close the path
SPIP released version 4.4.20 on 17 August to address CVE-2026-77647, another unauthenticated code-injection vulnerability rated 9.8. That flaw concerned how the template compiler identified PHP blocks and handled certain values through var_export. SPIP said exploitation attempts had been observed.
Version 4.4.20 was not the finish line. SPIP 4.4.21 followed on 20 August with a separate fix for the X-Spip-Filtre path tracked as CVE-2026-77806. The CVE record explicitly lists versions before 4.4.21 as affected, which includes the emergency 4.4.20 release.
This is why defenders should verify the installed version rather than assuming that an emergency update applied earlier in the week is sufficient. A server on 4.4.20 remains exposed to the later flaw.
Three vulnerabilities need separate treatment
| Vulnerability | Impact and prerequisites | Affected and fixed versions | Exploitation and PoC status |
|---|---|---|---|
| CVE-2026-66738 High, 8.8 CVSS 3.1 | Authenticated, low-privilege attacker can reach code injection through the navigation endpoint on SQLite-backed installations. MySQL-backed installations are not affected by this specific flaw. | SPIP before 4.4.18. Fixed in 4.4.18. Debian fixed its stable package in 4.4.19+dfsg-0+deb13u1. | No confirmed malicious exploitation or public exploit was identified for this CVE. |
| CVE-2026-77647 Critical, 9.8 | Remote unauthenticated code execution caused by incorrect identification of PHP blocks during template compilation. | SPIP before 4.4.20. Fixed in 4.4.20, but that release does not fix CVE-2026-77806. | The vendor reported exploitation attempts in August 2026. No separate public PoC was identified for this CVE. |
| CVE-2026-77806 Critical, 9.8 | Remote unauthenticated code execution through a crafted X-Spip-Filtre header mishandled by analyse_resultat_skel. | Every SPIP version before 4.4.21, including 4.4.20. Fixed in 4.4.21. | SPIP and CERT-FR report exploitation attempts. A public Metasploit module pull request provides reproducible exploit code. |
SPIP’s 4.4.18 bulletin also grouped additional issues involving SQL injection, unauthorised API editing, account modification, server-side request forgery and code injection in the private area. Those issues reinforce the need to move to the current release instead of attempting to isolate one endpoint.
What defenders should do now
- Upgrade to SPIP 4.4.21 or later. Do not stop at 4.4.20.
- Inventory every instance. Include staging sites, abandoned editorial portals, intranet copies and sites installed through hosting control panels.
- Review web logs. Search for unexpected
X-Spip-Filtreheaders, unusual requests around the SPIP template engine and outbound connections or file changes made by the web process. - Assume the security screen is insufficient. SPIP says the optional screen does not protect against these flaws.
- Contain suspicious hosts. If a site may have been exposed, preserve logs, rotate credentials available to the web application and inspect for persistence before returning it to service.
The BlackTree view
The dangerous part is not only that a content-management system had a pre-authentication RCE. It is that administrators following the first emergency instruction could still be vulnerable days later. Patch completion must be verified against the final fixed version, especially when a vendor releases successive critical updates under active exploitation pressure.
Sources
- SPIP 4.4.21 critical security release, published 20 August 2026 at 12:09 UTC.
- SPIP 4.4.20 critical security release, published 17 August 2026 at 10:27 UTC.
- SPIP 4.4.18 critical security release, published 10 August 2026 at 13:36 UTC.
- CERT-FR weekly bulletin confirming exploitation attempts and public proof of concept, published 24 August 2026. No publication time was provided.
- CERT-FR advisory CERTFR-2026-AVI-1063, first published 21 August and updated 24 August 2026. No publication time was provided.
- Rapid7 Metasploit module pull request, opened 17 August 2026.
