CVE-2016-7998

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier

Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading an HTML file with a crafted INCLUDE or INCLURE tag and then accessing it with a valider xml action.

Recommendations For SPIP versions 3.1.2 and earlier, consider restricting access to the template composer/compiler until a fix is available. As a temporary workaround, avoid using the INCLUDE and INCLURE tags in uploaded HTML files to minimize the risk of exploitation.