Description
SPIP before 4.3.2, 4.2.16, and
4.1.18 is vulnerable to a command injection issue. A
remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SPIP | SPIP | 4.3.0 – ≤ 4.3.1, 4.2.0 – ≤ 4.2.15, 4.1.0 – < 4.1.18 | 4.1.18 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spip | 4.3.2+dfsg-1 | — |
| Debian 13 | spip | 4.3.2+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | spip | No fix yet | — |
| Ubuntu 22.04 LTS | spip | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | spip | 3.2.7-1ubuntu0.1+esm2 | USN-7318-1 |
| Ubuntu Pro 18.04 LTS | spip | 3.1.4-4~deb9u5ubuntu0.1~esm2 | USN-7318-1 |
| Ubuntu Pro 16.04 LTS | spip | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
SPIP BigUp Plugin Unauthenticated RCE
exploit/multi/http/spip_bigup_unauth_rce
GitHub 2 repositories
-
Chocapikk/CVE-2024-8517 ★ 15 · Sep 6, 2024
SPIP BigUp Plugin Unauthenticated RCE
-
saadhassan77/SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517 ★ 1 · Aug 1, 2025
This Python exploit targets a critical unauthenticated Remote Code Execution (RCE) vulnerability in the BigUp plugin of SPIP CMS (≤ 4.3.1, 4.2.15, 4.1.17). It abuses the bigup_retrouver_fichiers para…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- SPIP BigUp Plugin - Remote Code Execution http/cves/2024/CVE-2024-8517.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- USN-7318-1 spip vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
References
- https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/ exploit technical-description
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html vendor-advisory
- https://vulncheck.com/advisories/spip-upload-rce third-party-advisory
- https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/ exploit technical-description