Multiple vulnerabilities affecting SPIP

SPIP is a publishing system for the Internet, used for the creation and management of websites. This system is affected by several vulnerabilities labeled as follows: CVE-2026-77806: This vulnerability results from code injection via an X-Spip-Filtre HTTP request header which is mishandled by the analysis_resultat_skel function. Exploitation of this vulnerability would allow an unauthenticated malicious actor to execute arbitrary code remotely. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1. CVE-2026-77647: This vulnerability is caused by incorrect identification of “<?php” blocks and poor handling of certain characters (such as ‘<‘) by var_export. Exploitation of this vulnerability would allow an unauthenticated malicious actor to execute arbitrary code remotely. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1. CVE-2026-66738: This vulnerability results from code injection in SQLite-based installations. The navigation menu hotspot incorrectly handles array-type user input, which bypasses input sanitization and allows the value to escape an internal string context when evaluated in PHP. Exploitation of this vulnerability would allow an authenticated attacker with at least editor (writer) privileges to execute arbitrary system commands. This vulnerability is classified as high with a severity score of 8.8 according to CVSS v3.1.

• SPIP versions prior to 4.4.21;
• SPIP versions prior to 4.4.20;
• SPIP versions prior to 4.4.18, specifically for installations using an SQLite database;