CVE-2026-77806

COMPONENT VERSION RANGE

NewScan fingerprints SPIP from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-22. 9.8, and NVD again records `as exploited in the wild in August 2026` - SPIP's second in-the-wild pre-auth RCE in three days, and NVD says it is related to the code injection fixed one release earlier, so 4.4.20 (yesterday's fix) is NOT enough. An unauthenticated attacker puts the payload in an `X-Spip-Filtre` REQUEST HEADER, which is worth noting for anyone reading a WAF rule off this row: the vector is not a parameter and not a path. A SECOND row rather than a wider `lt` on the CVE-2026-77647 row above, and this is the PeerTube precedent rather than the Mailpit one - the two advisories have different fix trains (4.4.20 and 4.4.21), so one merged `lt 4.4.21` row would keep claiming CVE-2026-77647 against a 4.4.20 install that has already fixed it. The cost is that a 4.4.19 install matches both rows and reports twice; both reports are true and both resolve to the same upgrade. Same `ge 4.4.0` and same reason as the row above: NVD gives no branch qualifier and SPIP backports on 4.1/4.2/4.3 in parallel, so an unbounded range would call a patched 4.3.x vulnerable. Version-match only. Reachable through the SPIP tech_signatures rows added 2026-08-21, which read the release from GET /CHANGELOG.md; ipeos/spip ships 4.4.21 and is therefore the patched arm for THIS row too (measured that day - the changelog's newest heading is literally `## 4.4.21 - 2026-08-20`), and the affected arm is a fixture case in tests/integration/tech_version_from_checks.py.