CVE-2016-7998

8.8 highEPSS 13%

The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-01-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

spip:spip

References

http://www.openwall.com/lists/oss-security/2016/10/05/17
http://www.openwall.com/lists/oss-security/2016/10/07/5
http://www.openwall.com/lists/oss-security/2016/10/08/6
http://www.securityfocus.com/bid/93451
https://core.spip.net/projects/spip/repository/revisions/23186

Check your stack JSON