Description
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spip | 4.1.8+dfsg-1 | — |
| Debian 13 | spip | 4.1.8+dfsg-1 | — |
| Debian 11 | spip | 3.2.11-3+deb11u7 | DSA-5367-1 |
| Debian 10 | spip | 3.2.4-1+deb10u10 | DLA-3347-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | spip | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | spip | 3.2.7-1ubuntu0.1+esm2 | USN-7318-1 |
| Ubuntu Pro 18.04 LTS | spip | 3.1.4-4~deb9u5ubuntu0.1~esm2 | USN-7318-1 |
| Ubuntu Pro 16.04 LTS | spip | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
SPIP form PHP Injection
exploit/multi/http/spip_rce_form
Exploit-DB 1
- SPIP v4.2.0 - Remote Code Execution (Unauthenticated) EDB-51536 · webapps · Jun 20, 2023 · verified
GitHub 13 repositories · most starred shown
-
nuts7/CVE-2023-27372 ★ 69 · Jun 19, 2023
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
-
Chocapikk/CVE-2023-27372 ★ 9 · Jun 25, 2023
SPIP Vulnerability Scanner - CVE-2023-27372 Detector
-
0SPwn/CVE-2023-27372-PoC ★ 6 · Jul 5, 2023
This is a PoC for CVE-2023-27372 which spawns a fully interactive shell.
-
Ap0dexMe0/CVE-2023-27372 ★ 3 · Jul 31, 2023
Perform With Mass Remote Code Execution In SPIP Version (4.2.1)
-
1Ronkkeli/spip-cve-2023-27372-rce ★ 2 · Apr 28, 2025
SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)
-
izzz0/CVE-2023-27372-POC ★ 2 · Jul 11, 2023
CVE-2023-27372-SPIP-CMS-Bypass
-
estebanzarate/CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC ★ 1 · Feb 24, 2026
Unauthenticated remote code execution vulnerability in SPIP before 4.2.1.
-
1amthebest1/CVE-2023-27372 ★ 0 · Aug 15, 2024
-
redboltsec/CVE-2023-27372-PoC ★ 0 · Sep 7, 2023
This is a PoC for CVE-2023-27372 and spawns a fully interactive shell.
-
dream434/CVE-2023-27372 ★ 0 · Jul 1, 2023
spip
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- SPIP - Remote Command Execution http/cves/2023/CVE-2023-27372.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 3
- USN-7318-1 spip vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5367-1 spip - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3347-1 spip - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html
- https://git.spip.net/spip/spip/commit/5aedf49b89415a4df3eb775eee3801a2b4b88266
- https://git.spip.net/spip/spip/commit/96fbeb38711c6706e62457f2b732a652a04a409d
- DSA-5367 vendor-advisory
- http://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/173044/SPIP-4.2.1-Remote-Code-Execution.html