SPIP EUVD-2026-63757

No special conditions - remote unauthenticated exploitation against default configurations of SPIP prior to 4.4.20 (AV:N/AC:L/PR:N/UI:N). The concrete technical prerequisite is that attacker-supplied data containing a '<' character reaches SPIP's var_export-based serialization into a generated PHP file, which the flawed <?php-block detection then treats as executable code - behavior present in the default template/cache-compilation pipeline, not a non-default feature. The primary limiting factor is version: only instances below 4.4.20 are vulnerable, so exploitation is bounded to unpatched deployments; no authentication, user interaction, or special platform is required.

All signals point to top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack with high confidentiality, integrity, and availability impact - the canonical profile of a wormable pre-auth RCE. The CVE description explicitly claims in-the-wild exploitation in August 2026, which, if accurate, elevates this from theoretical to urgent; however, the provided intelligence does NOT include an explicit CISA KEV flag or an EPSS score, so active-exploitation and probability signals cannot be independently confirmed from this dataset - the exploitation claim rests on the MITRE/CVE.org description alone. No SSVC decision block was supplied. Even discounting the exploitation claim, an unauthenticated RCE with a released patch and a public vendor advisory warrants emergency patching; the missing KEV/EPSS fields lower analytical certainty but do not lower the practical urgency.

An unauthenticated attacker sends a crafted HTTP request whose input contains a '<' character to a public SPIP instance running a version below 4.4.20. SPIP serializes that input via var_export into a cached PHP file, mis-parses the resulting <?php-like sequence, and executes the attacker's payload as PHP when the file is included - yielding remote code execution as the web server user. The CVE description reports this being exploited in the wild in August 2026; the low attack complexity (AC:L) and absence of required privileges make reliable mass exploitation plausible.