CVE-2016-7982

High

Published: 18/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Directory traversal vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate files on the system via the var_url parameter in a valider_xml action.

Risk Assessment

Attackers may gain access to the file structure of the system, potentially leading to the disclosure of sensitive information or further attacks.

Recommendation

It is recommended to upgrade to the latest version of SPIP and restrict access to configuration and system files.

Other vulnerabilities in SPIP 3.1.2 and earlier

CVE-2016-7999High
The valider_xml.php file in SPIP version 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.

Original NVD description (English source)

Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.