漏洞描述
SPIP < 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
securityonline.infohttps://securityonline.info/cve-2026-77806-spip-unauthenticated-rce/↗blog.spip.nethttps://blog.spip.net/↗blog.spip.nethttps://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html↗github.comhttps://github.com/rapid7/metasploit-framework/pull/21790↗github.comhttps://github.com/rapid7/metasploit-framework/pull/21790#issuecomment-5368038123↗github.comhttps://github.com/rapid7/metasploit-framework/pull/21790/commits/b16eca819abb8f1401f21d115e71e3dfc67b847c↗