PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7982 Spip CVE debrief

CVE-2016-7982 is a high-severity directory traversal issue in SPIP’s ecrire/exec/valider_xml.php. The NVD record says remote attackers could use the var_url parameter in a valider_xml action to enumerate files on the system. The vulnerability is listed as affecting SPIP 3.1.2 and earlier.

Vendor
Spip
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for SPIP 3.1.2 and earlier, especially on systems where the SPIP application is reachable over the network. Hosting providers and managed-service teams supporting SPIP deployments should also review exposure.

Technical summary

The NVD entry classifies the issue as CWE-22 (path traversal) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The affected CPE range in the record ends at SPIP 3.1.2. Reference links point to a vendor repository revision (23200), mailing-list discussion, and a third-party advisory describing the file-enumeration path traversal condition.

Defensive priority

High. The vulnerability is network-reachable, requires no privileges or user interaction per the published CVSS vector, and can expose file contents or file system layout through enumeration.

Recommended defensive actions

  • Upgrade SPIP to a version later than 3.1.2 or apply the vendor fix referenced in repository revision 23200.
  • Review whether ecrire/exec/valider_xml.php is exposed in your deployment and restrict access where possible.
  • Check logs and application telemetry for requests involving valider_xml or suspicious var_url values.
  • If immediate remediation is not possible, reduce exposure of the affected SPIP instance until patched.

Evidence notes

Based on the supplied NVD record and linked references: the vulnerability is CVE-2016-7982, published on 2017-01-18, with a later NVD modification timestamp of 2026-05-13. The record states SPIP 3.1.2 and earlier are vulnerable, identifies CWE-22, and provides the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. References include the SPIP revision 23200 patch entry and a Sysdream advisory about SPIP file enumeration via path traversal.

Official resources

The CVE was published on 2017-01-18. The reference set includes October 2016 mailing-list, patch, and advisory entries, which provide timing context for the public discussion and remediation activity.