Hey everyone! Today we’re looking at a critical security flaw affecting the SPIP Content Management System, tracked under CVE-2026-77806 with a maximum CVSS score of 9.8 (Critical). If you or your organization host public-facing SPIP installations (versions prior to 4.4.21), this is a high-priority threat that requires immediate attention and mitigation.
How the Vulnerability Works
The flaw lies inside SPIP’s core dynamic template engine, specifically within the analyse_resultat_skel function. During skeleton template rendering, SPIP processes user-supplied data to chain custom template filters. The security oversight occurs because SPIP trusts incoming HTTP request headers—specifically X-Spip-Filtre:
Unauthenticated Entry Point: Attackers target public template compilation endpoints (like comment or forum preview pages) without needing valid user sessions or administrative credentials.
Dynamic Code Injection: The template compiler ingests raw strings from the
X-Spip-Filtreheader and concatenates them directly into dynamic PHP code arrays without function allowlisting.Remote Command Execution: When executed, PHP runs native functions like
passthruorsystem, granting the attacker instant OS command execution under the web server user (www-data).
Because default protection scripts (écran de sécurité) inspect standard request bodies rather than custom HTTP headers, this attack bypasses built-in application controls effortlessly.
Quick Remediation Checklist
Apply Patches: Upgrade vulnerable SPIP setups to version 4.4.21 or later.
Filter Edge Traffic: Configure your WAF, Nginx, or Apache reverse proxies to drop any incoming request containing the
X-Spip-Filtreheader.Audit Access Logs: Check server access logs for anomalous GET or POST requests carrying custom
X-Spip-header parameters.
☕ Enjoyed this technical breakdown?
To view the full article—complete with structural diagrams, PoC terminal commands, and server log hunting examples—check out the full post on my blog: