Vulnerability intelligence

CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

2.3%

Riskier than 83% of all CVEs · checked 2026-10-03

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories