SPIP prior to version 4.4.20 is vulnerable to an unauthenticated remote code execution flaw that was actively exploited in August 2026. The flaw stems from the system’s incorrect handling of the opening PHP tag <?php and the function var_export, which can be manipulated to cause arbitrary code to execute on the host. This vulnerability allows an attacker to run any code with the privileges of the web server and, without user authentication, can compromise confidentiality, integrity, and availability of the affected site.

The flaw affects all installations of SPIP running any release older than 4.4.20. The product affected is SPIP:SPIP, available in every deployment that has not yet been upgraded to the 4.4.20 release or newer.

The CVSS score of 9.8 ranks this as a critical flaw, and with an EPSS score of 3%, the fact that it was exploited in the wild indicates a high likelihood of further attacks. It is not currently listed in the CISA KEV catalog, but the absence of that listing does not reduce the urgency. The likely attack vector is via the web interface or any improperly sanitized input that can trigger the PHP parsing logic. An attacker can execute code from any external source reachable to the SPIP instance.