SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code
# 🔴 CVE-2026-77647 — SPIP Unauthenticated Remote Code Execution
Pre-Authentication Remote Code Execution in SPIP CMS — All Versions Before 4.4.20
**CVE-2026-77647** is a **critical unauthenticated remote code execution (RCE)** vulnerability affecting all versions of **SPIP CMS** prior to **4.4.20**.
The flaw allows a remote attacker — **without any authentication or user interaction** — to execute arbitrary PHP code on the target server. It was **actively exploited in the wild** starting in August 2026, prompting an emergency patch by the SPIP team.
This tool automates the detection and exploitation of this vulnerability across multiple targets with configurable concurrency.
| **CVE ID** | [CVE-2026-77647]( |
| **Affected Versions** | All versions **before 4.4.20** |
| **Type** | Unauthenticated Remote Code Execution (RCE) |
| **CWE** | [CWE-94]( — Improper Control of Generation of Code (Code Injection) |
| **CVSS 3.1 Score** | **9.8 / 10 — CRITICAL** |
| **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **Authentication** | **None required** (Pre-Auth) |
| **Exploitation** | **Actively exploited in the wild** (August 2026) |
| **Patch** | SPIP 4.4.20 ([Advisory]( |
| **Attack Vector** | Network | Exploitable remotely over the internet |
| **Attack Complexity** | Low | No special conditions required |
| **Privileges Required** | None | No authentication needed |
| **User Interaction** | None | No victim action required |
| **Scope** | Unchanged | Impact limited to the vulnerable system |
| **Confidentiality** | High | Full read access to all data |
| **Integrity** | High | Full write / modify access |
| **Availability** | High | Complete denial of service possible |
The vulnerability stems from two interacting issues in the SPIP template engine:
│ 2. var_export() │──── Mishandles ' **Note:** Targets without a scheme (` or ` will default to `
[?] Target list (default: list.txt): list.txt
| `2` — Normal | 10 | 15s | ⚖️ Balanced |
[?] Proxy (blank = none): socks5://127.0.0.1:9050
> Supports HTTP/HTTPS/SOCKS proxies for anonymization.
Successful results are saved to `shells.txt`:
/etc/passwd
- 🔍 **Automatic SPIP version detection** via `Composed-By` header and page fingerprinting
- 🛡️ **Patched version skip** — automatically skips SPIP ≥ 4.4.20
- 📝 **Dual shell deployment** — command execution shell + file upload shell
- 📂 **Multi-path write** — attempts root, `IMG/`, `tmp/`, and `local/` directories
- ⚡ **Multi-threaded scanning** — configurable 5 to 50 concurrent threads
- 🌐 **Proxy support** — HTTP, HTTPS, and SOCKS proxy routing
- 📊 **Real-time status** — live progress with color-coded terminal output
- 💾 **Auto-save results** — all confirmed shells saved to output file
- [CVE-2026-77647 — CVE.org](
- [CVE-2026-77647 — NVD (NIST)](
- [SPIP Security Advisory — SPIP Blog](
- [CERTFR-2026-AVI-1033 — CERT-FR (ANSSI)](
- [Debian Security Tracker — CVE-2026-77647](
- [Rapid7 Vulnerability Database](
> **This tool is provided strictly for educational purposes and authorized security research only.**
> Usage of this tool against systems without **explicit written permission** from the system owner is **illegal** and may violate local, national, and international laws including but not limited to the **Computer Fraud and Abuse Act (CFAA)**, **UK Computer Misuse Act**, and equivalent legislation in other jurisdictions.
> The author assumes **no liability** and is **not responsible** for any misuse, damage, or illegal activity caused by this tool. By using this tool, you agree that:
> - You have **obtained proper authorization** before testing any target
> - You accept **full responsibility** for your actions
> - You will **comply with all applicable laws** and regulations
> - You understand that unauthorized access to computer systems is a **criminal offense**
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
