SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spip | Spip | 4.0.0 (including) | 4.1.18 (excluding) |
| Spip | Spip | 4.2.0 (including) | 4.2.15 (including) |
| Spip | Spip | 4.3.0 (including) | 4.3.0 (including) |
| Spip | Spip | 4.3.1 (including) | 4.3.1 (including) |
| Spip | Ubuntu | devel | * |
| Spip | Ubuntu | esm-apps/bionic | * |
| Spip | Ubuntu | esm-apps/focal | * |
| Spip | Ubuntu | esm-apps/jammy | * |
| Spip | Ubuntu | esm-apps/noble | * |
| Spip | Ubuntu | esm-apps/xenial | * |
| Spip | Ubuntu | focal | * |
| Spip | Ubuntu | jammy | * |
| Spip | Ubuntu | noble | * |
| Spip | Ubuntu | oracular | * |
| Spip | Ubuntu | upstream | * |