The Exploit Bulletin — Sunday, October 25, 2026: 1 issue requires action
Sunday, October 25, 2026 — 1 issue requires action. If you run none of the software below, you are done.
Affects: SPIP
1. Unauthenticated command injection via bigup multipart upload in SPIP (CVE-2024-8517)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
VulnCheck added this flaw to its known-exploited catalog on 2026-10-24 after its canary sensors recorded exploitation attempts that day, with further attempts on 2026-10-25, and three public exploits are available, so a public SPIP site still on a pre-fix build can be taken over with a single upload request.
SPIP's bigup file-upload handling lets a remote, unauthenticated attacker execute operating system commands on the web server by sending a crafted multipart file upload request to the public site. The flaw affects the 4.1, 4.2 and 4.3 branches as well as unmaintained branches such as 4.0 that use the bigup plugin.
Affected: SPIP 4.3.0 through 4.3.1; SPIP 4.2.0 through 4.2.15; SPIP 4.1.0 before 4.1.18; Unmaintained SPIP branches (e.g. 4.0) using the bigup plugin
How to Test: Check the SPIP version shown in the private area (espace privé) and treat anything below 4.3.2, 4.2.16 or 4.1.18 — or any 4.0/unmaintained branch with the bigup plugin — as vulnerable; also confirm the écran de sécurité (security screen) is at 1.6.3 or later. To look for prior abuse, review web-server access logs for multipart POST requests to public forms from unexpected sources, and inspect the host for unexpected files in upload directories, new processes, or outbound connections from the PHP user.
How to Patch: Upgrade to SPIP 4.3.2, 4.2.16 or 4.1.18 as appropriate for your branch. For unmaintained branches such as SPIP 4.0 that use bigup, install the latest version of the écran de sécurité (security screen) as a stop-gap, then migrate to a maintained SPIP release.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · VulnCheck XDB public exploit · VulnCheck XDB public exploit
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
