SPIP vulnerabilities
We track 23 vulnerabilities in SPIP products across 7 products. 23 are rated high or critical, and none are known to be exploited. The most recent was published on October 6, 2026.
Latest SPIP vulnerabilities
- 9.8 Critical severity
SPIP Crayons Plugin: Missing Authorization
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorizatio
- 9.8 Critical severity
SPIP: Improperly Controlled Modification of Dynamically-Determined Object Attributes
SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated attackers to write arbitrary rows to any SQL table lacking a champs_editables allowlist by supplying an attacker-controlled arg parameter resolvi
- 9.8 Critical severity
SPIP: Missing Authorization
SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check
- 7.5 High severity
SPIP: Improper Neutralization of Special Elements used in an SQL Command
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open
- 9.8 Critical severity
SPIP: Improper Control of Generation of Code
SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.
- 9.8 Critical severity
SPIP: Improper Control of Generation of Code
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<'
- 8.8 High severity
SPIP: Improper Control of Generation of Code
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string
- 8.1 High severity
SPIP: Improper Control of Generation of Code
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerabi
- 8.8 High severity
SPIP: Improper Control of Generation of Code
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability to achieve code execution that bypasses
- 8.8 High severity
SPIP: Function Call With Incorrect Variable or Reference as Argument
SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure because of STATUT mishandling.
- 8.8 High severity
SPIP: Improper Neutralization of Special Elements used in an SQL Command
SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw combined with PHP
- 7.5 High severity
SPIP: Authentication Bypass Using an Alternate Path or Channel
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login
- 8.8 High severity
interface_traduction_objets: Improper Neutralization of Special Elements used in an SQL Command
The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelines.php. When handling translation requests, the plugin reads the id_parent parameter from user-suppli
- 8.8 High severity
interface_traduction_objets: Improper Control of Generation of Code
The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that is rendered wit
- 9.8 Critical severity
tickets: Improper Control of Generation of Code
The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template
- 9.8 Critical severity
referer_spam: Improper Neutralization of Special Elements used in an SQL Command
The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it direct
- 8.1 High severity
SPIP: Deserialization of Untrusted Data
SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior access or another
- 9.8 Critical severity
Saisies pour formulaire: Improper Control of Generation of Code
The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately up
- 9.8 Critical severity
SPIP: External Control of File Name or Path
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
- 9.8 Critical severity
SPIP: Improper Neutralization of Directives in Dynamically Evaluated Code
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
- 9.8 Critical severity
Spip: Deserialization of Untrusted Data
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
- 9.8 Critical severity
Spip: Improper Neutralization of Special Elements used in an SQL Command
SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitrary code via a crafted POST request.
- 8.8 High severity
Spip: Improper Neutralization of Special Elements used in an SQL Command
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.