Back to Database
Status published
Critical
CVE-2024-8517
SPIP Bigup Multipart File Upload OS Command Injection
Vulnerability Description
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8517
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Louka Jacques-Chevallier
- Arthur Deloffre
References
More from SPIP
View All →CVE-2025-71244
SPIP < 4.4.5 Open Redirect via Login Form
Medium
5.1
CVE-2025-71243
SPIP Saisies Plugin < 5.11.1 Remote Code Execution
Critical
9.3
CVE-2025-71242
SPIP < 4.3.6 Authorization Bypass Leading to Content Disclosure
Medium
5.3
CVE-2025-71241
SPIP < 4.3.6 Cross-Site Scripting in Private Area
Medium
4.8
CVE-2025-71240
SPIP < 4.2.15 Cross-Site Scripting via Code Tags
Medium
4.8
Affected Vendor
SPIP
View all reports →Affected Software
SPIP
Vulnerable Versions:
4.3.0, 4.2.0, 4.1.0
Timeline
Official Publish:
September 6th, 2024
Last Modified:
November 22nd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1005
Data from Local System
Collection
T1105
Ingress Tool Transfer
Command and Control
T1574
Hijack Execution Flow
Privilege Escalation
T1565
Data Manipulation
Impact
T1059
Command and Scripting Interpreter
Execution
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1041
Exfiltration Over C2 Channel
Exfiltration