{"id":"CVE-2021-44123","aliases":["DEBIAN-CVE-2021-44123","DLA-2867-1","DSA-5028-1","EUVD-2021-30979","GHSA-6f8p-g935-8f29","UBUNTU-CVE-2021-44123","USN-5482-1","USN-5482-2"],"status":"published","title":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability,...","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02396,"percentile":0.84236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2021-12-22T00:00:00Z","modified":"2026-10-23T18:03:38Z","fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["3.2.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["3.2.12-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"spip","fixed_in":["3.1.4-4~deb9u5build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"spip","fixed_in":["3.2.7-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u4+deb9u2"}]}],"versions":["3.1.4-2","3.1.4-3","3.1.4-3~deb9u1","3.1.4-4~deb9u1","3.1.4-4~deb9u2","3.1.4-4~deb9u3","3.1.4-4~deb9u4","3.1.4-4~deb9u4+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1+deb10u5"}]}],"versions":["3.2.4-1","3.2.4-1+deb10u1","3.2.4-1+deb10u2","3.2.4-1+deb10u3","3.2.4-1+deb10u4"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-3+deb11u1"}]}],"versions":["3.2.11-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5build0.18.04.1"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5build0.18.04.1"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1"],"bundled":4}],"products":[{"vendor":"spip","product":"spip"}],"references":[{"url":"https://git.spip.net/spip/spip/commit/1cf91def15966406ddd0488cf9d1ecd1ae82d47a","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44123"},{"url":"https://github.com/advisories/GHSA-6f8p-g935-8f29"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44123","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44123","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5482-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5482-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26847","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-44123","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-26T11:57:30Z","modified":"2024-08-04T04:17:23.464Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-30979","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-26T11:57:30Z","modified":"2024-08-04T04:17:23Z","updated_at":"2026-11-03T03:24:12.005069Z"}],"ghsa":[{"id":"GHSA-6f8p-g935-8f29","title":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability,...","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-27T00:01:21Z","modified":"2023-02-03T05:05:20Z","cwes":["CWE-434"],"updated_at":"2026-11-02T14:53:43.432623Z"}],"nvd":[{"id":"CVE-2021-44123","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-26T12:15:07.927Z","modified":"2026-06-17T04:11:55.6Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:03.821385Z"}],"osv":[{"id":"CVE-2021-44123","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-26T12:15:07.927Z","modified":"2026-03-14T11:17:37.007635Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44123","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-26T12:15:07.927Z","modified":"2026-10-23T18:03:38.915316799Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-44123","description":"SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.","status":"published","published":"2022-01-26T12:15:00Z","modified":"2026-04-07T10:42:34.754336Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DLA-2867-1","title":"spip - security update","status":"published","published":"2021-12-29T00:00:00Z","modified":"2026-03-09T01:20:25.782869Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5028-1","title":"spip - security update","status":"published","published":"2021-12-22T00:00:00Z","modified":"2026-03-09T02:11:43.419845Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-5482-1","title":"spip vulnerabilities","description":"\nIt was discovered that SPIP incorrectly validated inputs. An authenticated\nattacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984)\n\nCharles Fol and Théo Gordyjan discovered that SPIP is vulnerable to Cross\nSite Scripting (XSS). If a user were tricked into browsing a malicious SVG\nfile, an attacker could possibly exploit this issue to execute arbitrary\ncode. This issue was only fixed in Ubuntu 21.10. (CVE-2021-44118,\nCVE-2021-44120, CVE-2021-44122, CVE-2021-44123)\n\nIt was discovered that SPIP incorrectly handled certain forms. A remote\nauthenticated editor could possibly use this issue to execute arbitrary code,\nand a remote unauthenticated attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-26846, CVE-2022-26847)\n","status":"published","published":"2022-06-16T16:22:11Z","modified":"2026-04-27T16:12:12.417691Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5482-2","title":"spip vulnerabilities","description":"USN-5482-1 fixed several vulnerabilities in SPIP. This update provides\nthe corresponding updates for Ubuntu 20.04 LTS for CVE-2021-44118,\nCVE-2021-44120, CVE-2021-44122 and CVE-2021-44123.\n\nOriginal advisory details:\n\n \n It was discovered that SPIP incorrectly validated inputs. An authenticated\n attacker could possibly use this issue to execute arbitrary code.\n This issue only affected Ubuntu 18.04 LTS. (CVE-2020-28984)\n \n Charles Fol and Théo Gordyjan discovered that SPIP is vulnerable to Cross\n Site Scripting (XSS). If a user were tricked into browsing a malicious SVG\n file, an attacker could possibly exploit this issue to execute arbitrary\n code. This issue was only fixed in Ubuntu 21.10. (CVE-2021-44118,\n CVE-2021-44120, CVE-2021-44122, CVE-2021-44123)\n \n It was discovered that SPIP incorrectly handled certain forms. A remote\n authenticated editor could possibly use this issue to execute arbitrary code,\n and a remote unauthenticated attacker could possibly use this issue to obtain\n sensitive information. (CVE-2022-26846, CVE-2022-26847)\n","status":"published","published":"2023-03-02T10:15:19Z","modified":"2026-04-27T16:11:43.785457Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}