Skip to content
Threat Feed
Subscribe
critical advisory

SPIP: Unauthenticated Remote Code Execution (CVE-2026-77647)

A critical unauthenticated remote code execution vulnerability in SPIP, involving the X-Spip-Filtre header, has available public proof-of-concept exploits, presenting a high risk for unpatched web servers.

CVE search metadata

CVE search record: CVE-2026-77647. Severity: critical. CVSS: 9.8. EPSS: 2.29%. KEV: no. Product: SPIP (< 4.4.20). Brief: SPIP: Unauthenticated Remote Code Execution (CVE-2026-77647). Brief link: https://feed.craftedsignal.io/briefs/2026-10-spip-rce-cve-2026-77647/

Triage facts

Revision 1
Applicability
SPIP (< 4.4.20)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 27, 10:52 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Very likely

CVE-2026-77647 is a critical remote code execution vulnerability affecting the SPIP web publishing system. The flaw is triggered via the 'X-Spip-Filtre' HTTP header, allowing unauthenticated attackers to execute arbitrary code on the target server. The vulnerability has a CVSS 3.1 score of 9.8. Proof-of-concept exploit code is publicly available, increasing the likelihood of exploitation.

Impact

Successful exploitation allows for unauthenticated remote code execution, leading to full server compromise, data exfiltration, or complete loss of availability.

Recommendation

  • Identify all internet-facing SPIP installations within your environment.
  • Patch SPIP instances immediately to the vendor-recommended version addressing CVE-2026-77647.
  • Monitor web server access logs for anomalous HTTP requests containing the 'X-Spip-Filtre' header.
  • Block identified malicious IP addresses associated with exploit attempts at the perimeter firewall or WAF.

Immediate actions

Deploy WAF or web server rule to filter/block requests containing the 'X-Spip-Filtre' header.

IT Operations 12h

Threat Hunt

Search web logs for 'X-Spip-Filtre' headers from external IPs.

T1190 high high confidence hunt now

Data: Web access logs (cs-headers, cs-uri-stem, c-ip)

Mitigations

Patch SPIP to 4.4.20 or later

immediate IT Operations

CVE-2026-77647

Detection coverage 1

Detect CVE-2026-77647 Exploitation - HTTP Request with X-Spip-Filtre Header

critical

Detects exploitation attempts against CVE-2026-77647 by identifying HTTP requests containing the X-Spip-Filtre header, which is the vector for the unauthenticated RCE.

sigma tactics: execution, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →