EUVD-2026-63948
GHSA-vgr8-rqwx-wqrp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N) network RCE via a single crafted request with no user interaction (AV:N/AC:L/UI:N), yielding full command execution as the web user (C:H/I:H/A:H, scope unchanged).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
AnalysisAI
Remote code execution in SPIP CMS versions prior to 4.4.21 lets unauthenticated attackers run arbitrary PHP/OS commands by abusing the template engine's X-Spip-Filtre header handling. A newline injected into a GET parameter forces analyse_resultat_skel() to treat an attacker-supplied header() call as a template filter chain, and a working Metasploit module (intval|_request|system) already achieves full command shell access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of SPIP versions below 4.4.21; the vulnerable analyse_resultat_skel() template processing is core functionality, not an optional feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single crafted HTTP GET request to spip.php with a newline-embedded parameter value that injects header("X-Spip-Filtre: intval|_request|system"), plus a POST parameter '0' carrying an OS command; SPIP compiles this into its template, executes the filter chain, and runs the command as the web-server user, returning a shell. A public Metasploit module (exploit/multi/http/spip_x_spip_filtre_rce) fully automates this, including an autocheck that invokes phpinfo() to confirm vulnerability. … |
| Remediation | Vendor-released patch: upgrade to SPIP 4.4.21, which fixes the analyse_resultat_skel() header mishandling, per the vendor advisory at https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SPIP CMS installations and their versions across your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, all
Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject
Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to en
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP
Remote code execution in SPIP before 4.4.20 allows unauthenticated attackers to run arbitrary PHP on the server by explo
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. Rated critical severity (CVSS 9.8), th
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. R
SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "ta
SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. Rated critical
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote a
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. Ra
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today