What is GHSA-wj6g-rh9q-6vvm?

GHSA-wj6g-rh9q-6vvm is a security advisory published by GitHub Security Advisories with Critical severity. SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...

Which CVE IDs does GHSA-wj6g-rh9q-6vvm cover?

GHSA-wj6g-rh9q-6vvm covers the following CVE IDs: CVE-2026-77647. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wj6g-rh9q-6vvm?

GHSA-wj6g-rh9q-6vvm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-wj6g-rh9q-6vvmCriticalCVSS 9.8

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...

Vendor

GitHub Security Advisories

Published

August 21, 2026

Last Modified

August 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-77647 →

📋 Description

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-77647
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-20.html
https://lists.debian.org/debian-security-announce/2026/msg00359.html
https://github.com/advisories/GHSA-wj6g-rh9q-6vvm