{"id":"CVE-2024-8517","aliases":["DEBIAN-CVE-2024-8517","EUVD-2024-49235","GHSA-7w4r-xxr6-xrcj","UBUNTU-CVE-2024-8517","USN-7318-1"],"status":"published","title":"SPIP Bigup Multipart File Upload OS Command Injection","description":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.94532,"percentile":0.99856,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-646","CWE-73","CWE-78"],"published":"2024-09-06T15:55:35Z","modified":"2026-10-30T09:49:13Z","exploits":[{"source":"pocgithub","id":"Chocapikk/CVE-2024-8517","title":"Chocapikk/CVE-2024-8517","date":"2024-09-06","url":"https://github.com/Chocapikk/CVE-2024-8517"},{"source":"metasploit","id":"exploit/multi/http/spip_bigup_unauth_rce","title":"SPIP BigUp Plugin Unauthenticated RCE","type":"exploit","platform":"Linux,PHP,Unix,Windows","date":"2024-09-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/spip_bigup_unauth_rce"},{"source":"pocgithub","id":"saadhassan77/SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517","title":"saadhassan77/SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517","date":"2025-08-01","url":"https://github.com/saadhassan77/SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517"},{"source":"nuclei","id":"CVE-2024-8517","title":"SPIP BigUp Plugin - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8517.yaml"}],"fixes":[{"ecosystem":"Debian:13","package":"spip","fixed_in":["4.3.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spip","fixed_in":["4.3.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","fixed_in":["3.1.4-4~deb9u5ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","fixed_in":["3.2.7-1ubuntu0.1+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.20-1","3.0.21-1","3.0.21-1ubuntu1","3.0.21-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1+esm2"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-3","3.2.12-1","4.0.2-1","4.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.11+dfsg-1","4.1.12+dfsg-1","4.1.13+dfsg-1","4.1.15+dfsg-1","4.2.9+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1+esm2"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1"],"bundled":8}],"products":[{"vendor":"spip","product":"spip"}],"references":[{"url":"https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/","tags":["exploit","technical-description","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://vulncheck.com/advisories/spip-upload-rce","tags":["third-party-advisory","Third Party Advisory","advisory","report"]},{"url":"https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/","tags":["exploit","technical-description","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8517"},{"url":"https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload"},{"url":"https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload"},{"url":"https://github.com/advisories/GHSA-7w4r-xxr6-xrcj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-8517","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8517","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7318-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27372","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-8517","title":"SPIP Bigup Multipart File Upload OS Command Injection","description":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T15:55:35.349Z","modified":"2026-10-29T21:15:10.704Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-73","CWE-78"],"updated_at":"2026-11-02T14:34:09.540667Z"}],"euvd":[{"id":"EUVD-2024-49235","description":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T15:55:35Z","modified":"2026-10-29T21:15:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:14.591479Z"}],"ghsa":[{"id":"GHSA-7w4r-xxr6-xrcj","title":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and...","description":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T18:31:32Z","modified":"2025-09-25T21:31:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73","CWE-646"],"updated_at":"2026-11-02T15:03:46.445668Z"}],"nvd":[{"id":"CVE-2024-8517","description":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T16:15:03.793Z","modified":"2026-10-29T21:17:03.65Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-73","CWE-78"],"updated_at":"2026-11-02T14:10:24.514378Z"}],"osv":[{"id":"CVE-2024-8517","description":"SPIP before 4.3.2, 4.2.16, and \n4.1.18 is vulnerable to a command injection issue. A \nremote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T16:15:03.793Z","modified":"2026-03-15T22:50:57.63694Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"DEBIAN-CVE-2024-8517","description":"SPIP before 4.3.2, 4.2.16, and  4.1.18 is vulnerable to a command injection issue. A  remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T16:15:03.793Z","modified":"2026-10-30T09:49:13.267327626Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"UBUNTU-CVE-2024-8517","description":"SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.","status":"published","published":"2024-09-06T16:15:00Z","modified":"2026-04-07T11:49:07.113168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"USN-7318-1","title":"spip vulnerabilities","description":"It was discovered that svg-sanitizer, vendored in SPIP, did not properly\nsanitize SVG/XML content. An attacker could possibly use this issue to\nperform cross site scripting. This issue only affected Ubuntu 24.10.\n(CVE-2022-23638)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform cross site\nscripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform PHP injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28961)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote authenticated attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-37155)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2023-24258)\n\nIt was discovered that SPIP did not properly handle serialization under\ncertain circumstances. A remote attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2023-27372)\n\nIt was discovered that SPIP did not properly sanitize HTTP requests. A\nremote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-8517)\n","status":"published","published":"2025-03-04T00:21:21Z","modified":"2026-04-27T18:02:20.676823681Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}