Description
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SPIP | SPIP | 4.3.0-alpha – < 4.3.0-alpha2, 4.2.0 – < 4.2.13, 4.1.0 – < 4.1.16 | 4.3.0-alpha2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spip | 4.3.0+dfsg-1 | — |
| Debian 13 | spip | 4.3.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | spip | No fix yet | — |
| Ubuntu 22.04 LTS | spip | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | spip | No fix yet | — |
| Ubuntu Pro 18.04 LTS | spip | No fix yet | — |
| Ubuntu Pro 16.04 LTS | spip | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
SPIP Unauthenticated RCE via porte_plume Plugin
exploit/multi/http/spip_porte_plume_previsu_rce
GitHub 9 repositories
-
Chocapikk/CVE-2024-7954 ★ 14 · Aug 10, 2024
Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12
-
gh-ost00/CVE-2024-7954-RCE ★ 10 · Sep 1, 2024
Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12
-
bigb0x/CVE-2024-7954 ★ 6 · Aug 28, 2024
This exploit will attempt to execute system commands on SPIP targets.
-
TheCyberguy-17/RCE_CVE-2024-7954 ★ 5 · Sep 23, 2024
-
0dayan0n/RCE_CVE-2024-7954- ★ 2 · Dec 28, 2024
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP …
-
ShivanshKuntal/Exploitation-of-a-Remote-Code-Execution-vulnerability--CVE-2024-7954- ★ 1 · Dec 11, 2025
Exploitation of a Remote Code Execution vulnerability- (CVE-2024-7954)
-
r0otk3r/CVE-2024-7954 ★ 0 · Jul 8, 2025
-
Arthikw3b/RCE-CVE-2024-7954 ★ 0 · Feb 5, 2025
-
zxj-hub/CVE-2024-7954POC ★ 0 · Dec 20, 2024
SPIP 4.30-alpha2、4.2.13、4.1.16之前的版本使用的porte_plume插件存在任意代码执行漏洞，远程未经身份验证的攻击者可以通过发送精心设计的HTTP 请求以SPIP用户身份执行任意PHP代码。
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- SPIP Porte Plume Plugin - Remote Code Execution http/cves/2024/CVE-2024-7954.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://vulncheck.com/advisories/spip-porte-plume third-party-advisory
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html vendor-advisory
- https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/ technical-description exploit