Description

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-20T23:16:28.647Z",
  "pubdate": "2026-08-20T23:16:28.647Z",
  "executiveSummary": "An unauthenticated remote code execution vulnerability exists in SPIP before version 4.4.20, which has been actively exploited in the wild as of August 2026. The flaw permits remote attackers with no prior authentication to execute arbitrary code on underlying target systems. The impact of this security deficiency is critical, potentially leading to complete system compromise, data exfiltration, and unauthorized access to the host infrastructure. The vulnerability stems from improper handling and identification of PHP blocks combined with unsafe usage of the var_export function when encountering specific characters such as the less-than symbol. Exploitation requires network connectivity to the vulnerable SPIP instance, but does not necessitate valid user credentials or privileged access. Organizations utilizing affected versions of SPIP face severe operational and security risks due to active exploitation vectors targeting this flaw in production environments.",
  "technicalDetails": "The vulnerability resides in the parsing and processing logic of SPIP before version 4.4.20, specifically involving the identification of PHP code blocks and the subsequent handling of data serialization or output generation via the var_export function. The root cause of the flaw is twofold: an incorrect mechanism for identifying and sanitizing PHP blocks within processed inputs, and the mishandling by var_export when processing specific edge cases, such as the presence of a '<' character. During standard operations, SPIP processes user-supplied or template-derived data. When an attacker supplies crafted input containing specific character sequences involving '<' alongside construct patterns that mimic or manipulate PHP blocks, the flawed identification logic fails to properly neutralize or sandbox the execution context. Concurrently, var_export processes the manipulated data structures in an unsafe manner, causing the application to interpret injected string representations as executable PHP code. The attack flow commences with an unauthenticated remote attacker transmitting a maliciously crafted HTTP request targeting the vulnerable SPIP application over the network. The request reaches the affected component responsible for evaluating or serializing template data and internal variables. Due to the breakdown in input validation and the mishandling of the '<' character within var_export operations, the input breaks out of its intended data context and transitions into an execution context. This allows the attacker to inject arbitrary PHP payloads into the execution stream. Upon processing, the server evaluates the injected instructions, resulting in arbitrary code execution under the security context of the web server user. The affected component is exposed over the network, requires zero authentication, and mandates no privileges for successful exploitation. Post-exploitation impact includes full system compromise, installation of persistent backdoors, access to sensitive database contents, and lateral movement within the compromised network infrastructure."
}