CVE-2024-8517: SPIP unauthenticated command injection via multipart file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityPre-authentication remote code execution with a CVSS of 9.8 and very high EPSS, plus public exploit write-ups, makes this an urgent patch target.

What it is

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to OS command injection. A remote, unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. This is a pre-authentication remote code execution flaw in a widely deployed CMS, so it warrants urgent patching.

Impact

An attacker gains arbitrary command execution on the server hosting SPIP, which typically means full compromise of the web application and its data. Depending on the service account, this can extend to the underlying host.

Attack surface

Reachable over the network via HTTP through a crafted multipart file upload request. No authentication and no user interaction are required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.946, 99.85th percentile) and public exploit write-ups are referenced, indicating active interest and likely weaponization.

What to do

• Upgrade SPIP to 4.3.2, 4.2.16, or 4.1.18 (or later) immediately.
• If patching cannot be done at once, restrict or block access to the SPIP upload endpoints at the reverse proxy or WAF.
• Run SPIP under a low-privilege service account with no shell and limited filesystem write access.
• Review server logs for suspicious multipart upload requests and unexpected child processes spawned by the web server.
• Apply network segmentation so a compromised SPIP host cannot reach internal management interfaces.

Detection

• Inspect HTTP logs for multipart/form-data POST requests to SPIP upload endpoints with unusual filenames or content types.
• Monitor for web server processes (php-fpm, apache, nginx) spawning shell or system binaries.
• Alert on outbound connections from the SPIP host to unknown IPs shortly after upload activity.
• Check for newly created files or webshells in SPIP upload and cache directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.