Description

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-21T14:16:53.903Z",
  "pubdate": "2026-08-21T14:16:53.903Z",
  "executiveSummary": "SPIP before 4.4.21 contains a critical code injection vulnerability that enables unauthenticated remote attackers to achieve arbitrary code execution on vulnerable systems. This security flaw has been actively exploited in the wild as of August 2026. The vulnerability stems from improper handling of specific HTTP request headers within the application framework, allowing malicious actors to supply crafted payloads that are subsequently evaluated or executed by the backend environment. The impact of this vulnerability is severe, as it grants complete system compromise to remote unauthorized entities over the network without requiring any prior authentication or privileged access. Given the active exploitation status in threat landscapes, organizations running affected versions of SPIP face an immediate and critical risk of unauthorized access, data exfiltration, and full infrastructure takeover. Mitigation requires prompt updating of the software to version 4.4.21 or later, alongside rigorous monitoring for anomalous HTTP header patterns indicative of exploitation attempts.",
  "technicalDetails": "The vulnerability resides in the core processing logic of SPIP before version 4.4.21, specifically within the handling and analysis of template results and HTTP request metadata. The root cause is attributed to insufficient sanitization and validation of input received through the X-Spip-Filtre HTTP request header, which is subsequently processed by the vulnerable function analyse_resultat_skel. Because the application improperly trusts and evaluates data supplied via this custom HTTP header, an unauthenticated remote attacker can inject arbitrary code payloads directly into the processing pipeline.\nThe exploitation method relies on network exposure, targeting web servers running vulnerable SPIP installations without requiring authentication or prior privileges. An attacker initiates the attack flow by crafting a malicious HTTP request containing a specially engineered payload within the X-Spip-Filtre header. Upon receipt, the SPIP application routes the request through its skeleton evaluation and result analysis mechanisms, specifically invoking analyse_resultat_skel, which fails to neutralize the malicious input. Consequently, the injected payload is mishandled and executed within the context of the web server process.\nThe payload behavior allows for the execution of arbitrary system commands or application-level code, depending on the underlying execution context. The post-exploitation impact includes complete system compromise, unauthorized data access, backdoor installation, and potential lateral movement within the hosting environment. Attackers have leveraged this vulnerability in the wild as of August 2026 to execute malicious operations stealthily via standard web traffic ports."
}