CVE-2016-3154

The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x...

9.8 CriticalFix available

CVE-2016-3154 is a critical vulnerability (CVSS 9.8) in Spip, published March 16, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 78th percentile. Fixed in spip 3.0.22-1.

The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.84%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-3154
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3154
Updated: 2026-11-02

EUVDEUVD-2016-4206 No score

Record: EUVD-2016-4206
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5fwq-26jx-xp73 9.8

The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x...

Record: GHSA-5fwq-26jx-xp73
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 9.8

Record: CVE-2016-3154
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-3154 9.8

Record: DEBIAN-CVE-2016-3154
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-3154 9.8

Record: UBUNTU-CVE-2016-3154
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

spip

Affected packages

Affected packages
Package	Affected	Fixed
`spip` Debian:13	before 3.0.22-1	3.0.22-1
`spip` Debian:14	before 3.0.22-1	3.0.22-1
`spip` Debian:7	before 2.1.17-1+deb7u5, plus listed versions 2.1.17-12.1.17-1+deb7u12.1.17-1+deb7u22.1.17-1+deb7u32.1.17-1+deb7u4	2.1.17-1+deb7u5
`spip` Debian:8	before 3.0.17-2+deb8u2, plus listed versions 3.0.17-23.0.17-2+deb8u1	3.0.17-2+deb8u2
`spip` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.0.20-13.0.21-13.0.21-1ubuntu13.0.21-1ubuntu1+esm1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV