GitHub - Nxploited/CVE-2026-77647: SPIP before 4.4.20 allows unauthenticated remote ...

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code

Pre-Authentication Remote Code Execution in SPIP CMS — All Versions Before 4.4.20

CVE-2026-77647 is a critical unauthenticated remote code execution (RCE) vulnerability affecting all versions of SPIP CMS prior to 4.4.20 .

The flaw allows a remote attacker — without any authentication or user interaction — to execute arbitrary PHP code on the target server. It was actively exploited in the wild starting in August 2026, prompting an emergency patch by the SPIP team.

This tool automates the detection and exploitation of this vulnerability across multiple targets with configurable concurrency.

🛡️ Vulnerability Details

⚙️ CVSS 3.1 Breakdown

The vulnerability stems from two interacting issues in the SPIP template engine:

Incorrect <?php block identification — SPIP's template engine fails to properly sanitize PHP opening tags within user-controlled input, specifically in the ( recherche ) parameter.

Incorrect <?php block identification — SPIP's template engine fails to properly sanitize PHP opening tags within user-controlled input, specifically in the ( recherche ) parameter.

var_export mishandling — PHP's var_export() function mishandles certain edge cases, particularly when the input contains the < character, allowing the injection of executable PHP code.

var_export mishandling — PHP's var_export() function mishandles certain edge cases, particularly when the input contains the < character, allowing the injection of executable PHP code.

The attacker sends a crafted payload through the SPIP functionality ( ?page=recherche&recherche=PAYLOAD ). The payload abuses the X-Spip-Filtre HTTP header mechanism to trigger html_entity_decode , which decodes the injected PHP code. The decoded code is then evaluated by SPIP's template rendering engine, achieving arbitrary code execution.

Create a file named list.txt (or any custom name) with one target per line:

Note: Targets without a scheme ( http:// or https:// ) will default to http:// .

Note: Targets without a scheme ( http:// or https:// ) will default to http:// .

Interactive Configuration

The tool will prompt you for:

Supports HTTP/HTTPS/SOCKS proxies for anonymization.

Supports HTTP/HTTPS/SOCKS proxies for anonymization.

Successful results are saved to shells.txt :

File Upload Interface:

🔍 Automatic SPIP version detection via Composed-By header and page fingerprinting

🛡️ Patched version skip — automatically skips SPIP ≥ 4.4.20

📝 Dual shell deployment — command execution shell + file upload shell

📂 Multi-path write — attempts root, IMG/ , tmp/ , and local/ directories

⚡ Multi-threaded scanning — configurable 5 to 50 concurrent threads

🌐 Proxy support — HTTP, HTTPS, and SOCKS proxy routing

📊 Real-time status — live progress with color-coded terminal output

💾 Auto-save results — all confirmed shells saved to output file

CVE-2026-77647 — CVE.org

CVE-2026-77647 — NVD (NIST)

SPIP Security Advisory — SPIP Blog

CERTFR-2026-AVI-1033 — CERT-FR (ANSSI)

Debian Security Tracker — CVE-2026-77647

Rapid7 Vulnerability Database

This tool is provided strictly for educational purposes and authorized security research only. Usage of this tool against systems without explicit written permission from the system owner is illegal and may violate local, national, and international laws including but not limited to the Computer Fraud and Abuse Act (CFAA) , UK Computer Misuse Act , and equivalent legislation in other jurisdictions. The author assumes no liability and is not responsible for any misuse, damage, or illegal activity caused by this tool. By using this tool, you agree that: You have obtained proper authorization before testing any target You accept full responsibility for your actions You will comply with all applicable laws and regulations You understand that unauthorized access to computer systems is a criminal offense Use responsibly. Hack ethically.

This tool is provided strictly for educational purposes and authorized security research only.

Usage of this tool against systems without explicit written permission from the system owner is illegal and may violate local, national, and international laws including but not limited to the Computer Fraud and Abuse Act (CFAA) , UK Computer Misuse Act , and equivalent legislation in other jurisdictions.

The author assumes no liability and is not responsible for any misuse, damage, or illegal activity caused by this tool. By using this tool, you agree that:

You have obtained proper authorization before testing any target

You accept full responsibility for your actions

You will comply with all applicable laws and regulations

You understand that unauthorized access to computer systems is a criminal offense

Use responsibly. Hack ethically.

By: Khaled Alenazi @Nxploited