SPIP EUVD-2026-63948

No special conditions - remote unauthenticated exploitation against default configurations of SPIP versions below 4.4.21; the vulnerable analyse_resultat_skel() template processing is core functionality, not an optional feature. The concrete prerequisite is simply a reachable SPIP endpoint (e.g. spip.php) that renders templates, which is the normal operating state of the CMS. Limiting factors are minimal: the target must be running an affected version (<4.4.21) on a Unix/Linux PHP host, and the injected commands execute with the privileges of the web-server user (the Metasploit run shows the shell as user 'jvoisin', i.e. non-root/'Privileged' => false), so impact is bounded by that account's permissions absent further privilege escalation.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) indicates unauthenticated network exploitation with low complexity and full impact, and that assessment is corroborated by a functional, publicly available Metasploit module demonstrating an interactive shell - the two strongest independent signals align. The CVE description asserts active in-the-wild exploitation in August 2026, but this is NOT independently confirmed via CISA KEV in the supplied data, so it should be treated as a strong claim pending KEV/vendor confirmation rather than established fact. No EPSS score and no SSVC decision data were provided, so probability-of-exploitation and automatability cannot be quantified from this input; however, the existence of weaponized exploit code effectively removes the barrier to exploitation regardless. Any organization running an internet-facing SPIP instance below 4.4.21 should treat this as an emergency patch, since the exploit requires no credentials and no user interaction.

An attacker sends a single crafted HTTP GET request to spip.php with a newline-embedded parameter value that injects header("X-Spip-Filtre: intval|_request|system"), plus a POST parameter '0' carrying an OS command; SPIP compiles this into its template, executes the filter chain, and runs the command as the web-server user, returning a shell. A public Metasploit module (exploit/multi/http/spip_x_spip_filtre_rce) fully automates this, including an autocheck that invokes phpinfo() to confirm vulnerability. Because AV:N/AC:L/PR:N/UI:N, no authentication, victim interaction, or special network position is required.