{"id":"CVE-2024-7954","aliases":["DEBIAN-CVE-2024-7954","EUVD-2024-48791","GHSA-42mv-3h37-wfh9","UBUNTU-CVE-2024-7954"],"status":"published","title":"SPIP porte_plume Plugin Arbitrary PHP Execution","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.90053,"percentile":0.99798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1286","CWE-284","CWE-95"],"published":"2024-08-23T17:43:20Z","modified":"2026-11-02T12:03:15Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/spip_porte_plume_previsu_rce","title":"SPIP Unauthenticated RCE via porte_plume Plugin","type":"exploit","platform":"Linux,PHP,Unix,Windows","date":"2024-08-16","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/spip_porte_plume_previsu_rce"},{"source":"nuclei","id":"CVE-2024-7954","title":"SPIP Porte Plume Plugin - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7954.yaml"},{"source":"pocgithub","id":"0dayan0n/RCE_CVE-2024-7954-","title":"0dayan0n/RCE_CVE-2024-7954-","date":"2024-12-28","url":"https://github.com/0dayan0n/RCE_CVE-2024-7954-"},{"source":"pocgithub","id":"Arthikw3b/RCE-CVE-2024-7954","title":"Arthikw3b/RCE-CVE-2024-7954","date":"2025-02-05","url":"https://github.com/Arthikw3b/RCE-CVE-2024-7954"},{"source":"pocgithub","id":"Chocapikk/CVE-2024-7954","title":"Chocapikk/CVE-2024-7954","date":"2024-08-10","url":"https://github.com/Chocapikk/CVE-2024-7954"},{"source":"pocgithub","id":"ShivanshKuntal/Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954-","title":"ShivanshKuntal/Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954-","date":"2025-12-11","url":"https://github.com/ShivanshKuntal/Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954-"},{"source":"pocgithub","id":"TheCyberguy-17/RCE_CVE-2024-7954","title":"TheCyberguy-17/RCE_CVE-2024-7954","date":"2024-09-23","url":"https://github.com/TheCyberguy-17/RCE_CVE-2024-7954"},{"source":"pocgithub","id":"bigb0x/CVE-2024-7954","title":"bigb0x/CVE-2024-7954","date":"2024-08-28","url":"https://github.com/bigb0x/CVE-2024-7954"},{"source":"pocgithub","id":"gh-ost00/CVE-2024-7954-RCE","title":"gh-ost00/CVE-2024-7954-RCE","date":"2024-09-01","url":"https://github.com/gh-ost00/CVE-2024-7954-RCE"},{"source":"pocgithub","id":"r0otk3r/CVE-2024-7954","title":"r0otk3r/CVE-2024-7954","date":"2025-07-08","url":"https://github.com/r0otk3r/CVE-2024-7954"},{"source":"pocgithub","id":"zxj-hub/CVE-2024-7954POC","title":"zxj-hub/CVE-2024-7954POC","date":"2024-12-20","url":"https://github.com/zxj-hub/CVE-2024-7954POC"}],"fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["4.3.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["4.3.0+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1","3.1.4-4~deb9u5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1","3.2.7-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-3","3.2.12-1","4.0.2-1","4.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.11+dfsg-1","4.1.12+dfsg-1","4.1.13+dfsg-1","4.1.15+dfsg-1","4.2.9+dfsg-2"]}],"products":[{"vendor":"spip","product":"spip"}],"references":[{"url":"https://vulncheck.com/advisories/spip-porte-plume","tags":["third-party-advisory","advisory","report"]},{"url":"https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html","tags":["vendor-advisory","article","report"]},{"url":"https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/","tags":["technical-description","exploit","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7954"},{"url":"https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather"},{"url":"https://github.com/advisories/GHSA-42mv-3h37-wfh9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-7954","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-7954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7954","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-7954","title":"SPIP porte_plume Plugin Arbitrary PHP Execution","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T17:43:20.967Z","modified":"2025-11-22T12:12:14.668Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-95","CWE-1286"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-48791","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T17:43:20Z","modified":"2025-11-22T12:12:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:13.665045Z"}],"ghsa":[{"id":"GHSA-42mv-3h37-wfh9","title":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an...","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T18:33:03Z","modified":"2025-09-23T18:31:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-95","CWE-284"],"updated_at":"2026-11-02T15:03:44.216026Z"}],"nvd":[{"id":"CVE-2024-7954","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T18:15:07.677Z","modified":"2026-06-17T08:21:16.22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-95","CWE-1286"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"DEBIAN-CVE-2024-7954","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T18:15:07.677Z","modified":"2026-11-02T12:03:15.798183772Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"UBUNTU-CVE-2024-7954","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T18:15:00Z","modified":"2026-04-07T11:45:08.970914Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CVE-2024-7954","description":"The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.","status":"published","published":"2024-08-23T18:15:07Z","modified":"2026-04-10T05:19:45.277275Z","updated_at":"2026-11-02T15:44:45.405014Z"}]}}