Unauthenticated remote code execution in SPIP via X-Spip-Filtre header (CVE-2026-77806)
The CVE record itself documents in-the-wild exploitation this month, VulnCheck added it to its known-exploited catalog today, and a Metasploit module is public — unpatched SPIP sites are being compromised now.
SPIP before 4.4.21 mishandles a crafted X-Spip-Filtre HTTP request header in analyse_resultat_skel, allowing an unauthenticated remote attacker to inject and execute arbitrary code on the web server. A single crafted HTTP request yields full application-level compromise.
Affected: SPIP < 4.4.21
How to Test
Check your SPIP version (ecrire/inc_version.php or the admin footer) — anything below 4.4.21 is vulnerable. Search web server and reverse-proxy logs for requests carrying an X-Spip-Filtre header; any occurrence is a strong indicator of attack attempts. Inspect the docroot for recently modified PHP files or unexpected webshells if the header appears in logs.
How to Patch
Upgrade to SPIP 4.4.21 immediately (critical security release per the SPIP project blog). If you cannot patch today, strip or block the X-Spip-Filtre request header at your reverse proxy or WAF as an interim mitigation, then upgrade.