CVE-2016-7982

Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows...

7.5 HighPublic exploitFix available

Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

20.5%Up 10.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2016-7982
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-7982
Updated: 2026-11-02

EUVDEUVD-2016-8830 No score

Record: EUVD-2016-8830
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6r9c-25q3-26fc 7.5

Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows...

Record: GHSA-6r9c-25q3-26fc
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 7.5

Record: CVE-2016-7982
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-7982 7.5

Record: DEBIAN-CVE-2016-7982
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-7982 7.5

Record: UBUNTU-CVE-2016-7982
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

spip

Affected packages

Affected packages
Package	Affected	Fixed
`spip` Debian:13	before 3.1.3-1	3.1.3-1
`spip` Debian:14	before 3.1.3-1	3.1.3-1
`spip` Debian:7 From an advisory covering 5 CVEs	before 2.1.17-1+deb7u6, plus listed versions 2.1.17-12.1.17-1+deb7u12.1.17-1+deb7u22.1.17-1+deb7u32.1.17-1+deb7u42.1.17-1+deb7u5	2.1.17-1+deb7u6
`spip` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.0.20-13.0.21-13.0.21-1ubuntu13.0.21-1ubuntu1+esm1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	SPIP 3.1.1/3.1.2 - File Enumeration / Path Traversal	2016-10-20

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-7982 is a high vulnerability (CVSS 7.5) in Spip, published November 2, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 20.5%, the 97th percentile. Fixed in spip 3.1.3-1.

References

Show 7 moreShow less