CVE-2022-37155

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via...

8.8 HighFix available

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

40.0%Up 37.2 points since Dec 14, 2022

What each source reports

NVD Score used 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Record: CVE-2022-37155
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

CVE List 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Record: CVE-2022-37155
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2022-39808 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Record: EUVD-2022-39808
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7c7w-25xj-4mp8 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via...

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via a GET parameter

Record: GHSA-7c7w-25xj-4mp8
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Record: CVE-2022-37155
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-37155 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Record: DEBIAN-CVE-2022-37155
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-37155 8.8

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.

Record: UBUNTU-CVE-2022-37155
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-7318-1 No score

spip vulnerabilities

It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 24.10. (CVE-2022-23638)

It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)

It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform PHP injection attacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)

It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform SQL injection attacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28961)

It was discovered that SPIP did not properly sanitize certain inputs. A remote authenticated attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-37155)

It was discovered that SPIP did not properly handle serialization under certain circumstances. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2023-27372)

It was discovered that SPIP did not properly sanitize HTTP requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2024-8517)

Record: USN-7318-1
Updated: 2026-11-02

Affected products

spip

Affected packages

Affected packages
Package	Affected	Fixed
`spip` Debian:13	before 4.1.5+dfsg-1	4.1.5+dfsg-1
`spip` Debian:14	before 4.1.5+dfsg-1	4.1.5+dfsg-1
`spip` Debian:10	before 3.2.4-1+deb10u9, plus listed versions 3.2.4-13.2.4-1+deb10u13.2.4-1+deb10u23.2.4-1+deb10u33.2.4-1+deb10u4 Show 4 moreShow less 3.2.4-1+deb10u53.2.4-1+deb10u63.2.4-1+deb10u73.2.4-1+deb10u8	3.2.4-1+deb10u9
`spip` Debian:11	before 3.2.11-3+deb11u5, plus listed versions 3.2.11-33.2.11-3+deb11u13.2.11-3+deb11u23.2.11-3+deb11u33.2.11-3+deb11u4	3.2.11-3+deb11u5
`spip` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.0.20-13.0.21-13.0.21-1ubuntu13.0.21-1ubuntu1+esm1	None known
`spip` Ubuntu:Pro:18.04:LTS	before 3.1.4-4~deb9u5ubuntu0.1~esm2, plus listed versions 3.1.4-33.1.4-4~deb9u3build0.18.04.13.1.4-4~deb9u5build0.18.04.1	3.1.4-4~deb9u5ubuntu0.1~esm2
`spip` Ubuntu:22.04:LTS	All versions, plus listed versions 3.2.11-33.2.12-14.0.2-14.0.4-1	None known
`spip` Ubuntu:Pro:18.04:LTS From an advisory covering 8 CVEs	before 3.1.4-4~deb9u5ubuntu0.1~esm2, plus listed versions 3.1.4-33.1.4-4~deb9u3build0.18.04.13.1.4-4~deb9u5build0.18.04.1	3.1.4-4~deb9u5ubuntu0.1~esm2
`spip` Ubuntu:Pro:20.04:LTS From an advisory covering 8 CVEs	before 3.2.7-1ubuntu0.1+esm2, plus listed versions 3.2.4-13.2.5-13.2.7-13.2.7-1ubuntu0.1	3.2.7-1ubuntu0.1+esm2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37155 is a high vulnerability (CVSS 8.8) in Spip, published July 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 40.0%, the 98th percentile. Fixed in spip 4.1.5+dfsg-1.

References

Show 11 moreShow less