CVE-2009-3041

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire...

7.5 HighPublic exploitFix available

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009.

Exploit likelihood

6.59%Up 2.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2009-3041
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-3041
Updated: 2026-11-02

EUVDEUVD-2009-3025 No score

Record: EUVD-2009-3025
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jjfc-23rr-g872 No score

SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire...

Record: GHSA-jjfc-23rr-g872
Updated: 2026-11-02

OSV No score

Record: CVE-2009-3041
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-3041 No score

Record: DEBIAN-CVE-2009-3041
Updated: 2026-11-02

Affected products

spip

Affected packages

Affected packages
Package	Affected	Fixed
`spip` Debian:13	before 2.0.9-1	2.0.9-1
`spip` Debian:14	before 2.0.9-1	2.0.9-1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	SPIP < 2.0.9 - Arbitrary Copy All Passwords to '.XML' File	2009-08-18

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3041 is a high vulnerability (CVSS 7.5) in Spip, published September 1, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.59%, the 93rd percentile. Fixed in spip 2.0.9-1.