CVE-2026-77806 is a remote code execution vulnerability in SPIP's filter pipeline. The vulnerability allows unauthenticated attackers to inject executable filter directives through the X-Spip-Filtre HTTP header, which gets processed by the analyse_resultat_skel function as if it originated from a trusted internal source. This is not merely a missing sanitization bug — it represents a fundamental architectural failure where a feature designed for developer convenience or internal debugging was never re-evaluated for production exposure. The CVSS 9.8 rating is accurate but undersells the systemic lesson: CMS extensibility APIs consistently become catastrophic attack surfaces when developers assume that plugin or filter invocation contexts remain internally-controlled.
The critical insight defenders should internalize: the exposure window for this vulnerability extends well beyond the CVE publication date. The phrase 'exploited in the wild before disclosure' is forensic language indicating attackers reverse-engineered the vulnerable code path from production systems — meaning the attack vector was actively weaponized while defenders had zero visibility into it. Every SPIP instance running vulnerable versions was not just 'unpatched' during that window — it was actively serving attacker-controlled output through cached pages, RSS feeds, and email notifications to downstream consumers.
For defenders: verify your SPIP version immediately (vulnerable through 4.4.20). The fix in 4.4.21 should be treated as urgent as any critical vulnerability, but also conduct a forensic review of HTTP access logs for any requests containing X-Spip-Filtre headers — their presence indicates reconnaissance or active exploitation. Beyond patching, the architectural lesson is that any feature accepting filter directives, template instructions, or code-like input must treat HTTP headers as adversarial input sources, regardless of whether the feature was originally intended for internal use. The pattern of CMS filter/plugin APIs being exploited via HTTP request manipulation has repeated across Drupal, WordPress, and Joomla — each instance generates post-mortems that don't translate into structural changes in how CMS architectures handle the boundary between network input and code-execution contexts.