Universal pre-auth remote code execution in SPIP CMS, fixed in 4.4.20 (CVE-2026-77647)
SPIP's own maintainers confirm exploitation attempts are already occurring in the wild and warn the built-in security screen offers no protection, so any SPIP site not upgraded this week should be assumed compromisable.
A flaw in how SPIP identifies <?php blocks, combined with var_export mishandling of inputs containing a '<' character, allows an unauthenticated remote attacker to execute arbitrary PHP code on any SPIP site with no preconditions. The vulnerability affects all SPIP versions before 4.4.20 and is not mitigated by SPIP's 'écran de sécurité' hardening screen.
Affected: SPIP all versions before 4.4.20
How to Test
Check your version in the SPIP admin (ecrire) footer or in ecrire/inc_version.php — anything below 4.4.20 is exploitable. Audit the site for unexpected PHP files in tmp/, local/, and IMG/ directories and review web logs for anomalous POST requests to public forms, since exploitation leaves attacker-written PHP on disk.
How to Patch
Upgrade immediately to SPIP 4.4.20, either through your package manager (Debian has issued an update) or via spip_loader 7.0.0 from https://get.spip.net/; the security screen does NOT protect against this flaw, so patching is the only remedy.