SPIP vulnerabilities

SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server.

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attackers to execute arbitrary code in the context of the web server.

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

SPIP before version 4.4.20 contains a vulnerability allowing unauthenticated remote attackers to execute arbitrary code. The issue is related to incorrect identification of <?php blocks and var_export's mishandling of certain cases such as the presence of a '<' character. This vulnerability was exploited in the wild in August 2026.

SPIP versions 3.1.x before 3.1.6 and 3.2.x before Beta 3 do not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution.

SPIP versions 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allow remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.

In SPIP before version 4.4.15, the file action/cookie.php in the ecrire directory is prone to an open redirect vulnerability.