Unauthenticated command injection via bigup multipart upload in SPIP (CVE-2024-8517)
VulnCheck added this flaw to its known-exploited catalog on 2026-10-24 after its canary sensors recorded exploitation attempts that day, with further attempts on 2026-10-25, and three public exploits are available, so a public SPIP site still on a pre-fix build can be taken over with a single upload request.
SPIP's bigup file-upload handling lets a remote, unauthenticated attacker execute operating system commands on the web server by sending a crafted multipart file upload request to the public site. The flaw affects the 4.1, 4.2 and 4.3 branches as well as unmaintained branches such as 4.0 that use the bigup plugin.
Affected: SPIP 4.3.0 through 4.3.1; SPIP 4.2.0 through 4.2.15; SPIP 4.1.0 before 4.1.18; Unmaintained SPIP branches (e.g. 4.0) using the bigup plugin
How to Test
Check the SPIP version shown in the private area (espace privé) and treat anything below 4.3.2, 4.2.16 or 4.1.18 — or any 4.0/unmaintained branch with the bigup plugin — as vulnerable; also confirm the écran de sécurité (security screen) is at 1.6.3 or later. To look for prior abuse, review web-server access logs for multipart POST requests to public forms from unexpected sources, and inspect the host for unexpected files in upload directories, new processes, or outbound connections from the PHP user.
How to Patch
Upgrade to SPIP 4.3.2, 4.2.16 or 4.1.18 as appropriate for your branch. For unmaintained branches such as SPIP 4.0 that use bigup, install the latest version of the écran de sécurité (security screen) as a stop-gap, then migrate to a maintained SPIP release.