CVE-2024-8517: critical vulnerability in SPIP
SPIP Bigup Multipart File Upload OS Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 95%
from disclosure to weaponsame day
Published on NVDSep 6
1st PoCSep 6
metasploitSep 6
VulnCheck+778d
SPIP before 4.3.2, 4.2.16, and
4.1.18 is vulnerable to a command injection issue. A
remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SPIP · SPIPpublic PoCs found — 8
githubgithub.com/Chocapikk/CVE-2024-8517★ 16githubgithub.com/saadhassan77/SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517★ 1vulncheckvulncheck.com/xdb/d995a2426525unverifiedvulncheckvulncheck.com/xdb/fae432c61c38unverifiedvulncheckvulncheck.com/xdb/a1e67bb94444unverifiedcve_referencethinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/unverifiedvulncheckvulncheck.com/xdb/7449b8270a27unverifiedcve_referencevozec.fr/researchs/spip-preauth-rce-2024-big-upload/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SPIP
In the same product, most dangerous first.
CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2026-77806CRITICALCVE-2026-77806EPSS 4.5%CVE-2026-77647CRITICALCVE-2026-77647EPSS 2.3%CVE-2026-72710CRITICALSPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionEPSS 1.1%CVE-2026-27475CRITICALSPIP < 4.4.9 Insecure DeserializationEPSS 0.9%CVE-2026-72709CRITICALSPIP < 4.4.18 Missing Authorization via ecrire/action/EPSS 0.7%