CVE-2026-77647

COMPONENT VERSION RANGE

NewScan fingerprints SPIP from its response and reports this CVE when the detected version falls inside the affected range below.

9.8, and NVD records it as `exploited in the wild in August 2026` - the only in-the-wild pre-auth RCE in today's window that is not on CISA KEV. SPIP mis-identifies `<?php` open tags while filtering user content, so an unauthenticated attacker's payload survives into a file SPIP later executes. Version-match only: proving it means executing code on a customer's CMS. The lower bound `ge 4.4.0` is OURS, not the advisory's - NVD says `before 4.4.20` with no branch qualifier, and SPIP maintains 4.1/4.2/4.3 in parallel with their own backport trains, so an unqualified `lt 4.4.20` would call a 4.3.x that HAS its fix vulnerable because 4.3.x sorts below 4.4.20. Confining the claim to the branch the advisory actually names is the Bouncy Castle LTS precedent: under-reporting beats a wrong claim, and the older branches get rows when their fixed versions are readable. Reachable as of today because the new SPIP tech_signatures rows supply the version from GET /CHANGELOG.md - measured 2026-08-21 against ipeos/spip on loopback, which ships 4.4.21 and is therefore the PATCHED arm (this row correctly stays silent on it); the affected arm is pinned as a fixture case in tests/integration/tech_version_from_checks.py because no versioned older image is published.