PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7999 Spip CVE debrief

CVE-2016-7999 is a high-severity server-side request forgery issue in SPIP 3.1.2 and earlier. A remote attacker can supply a URL through the var_url parameter in the valider_xml action, causing the server to make requests on the attacker’s behalf. NVD classifies the weakness as CWE-918 and scores it 7.4 with a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N.

Vendor
Spip
Product
Unknown
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

SPIP operators and administrators, especially for internet-facing or internally connected deployments running version 3.1.2 or earlier.

Technical summary

The affected code path is ecrire/exec/valider_xml.php. The vulnerability is exposed through the var_url parameter in the valider_xml action and allows SSRF. Per NVD, the attack is network-reachable, requires no privileges, does require user interaction, and is associated with high integrity impact and scope change. The supplied metadata limits the technical detail to the URL parameter and the documented version range up to 3.1.2.

Defensive priority

High

Recommended defensive actions

  • Upgrade SPIP to a version newer than 3.1.2 on every affected instance.
  • Restrict access to the administrative valider_xml endpoint and related SPIP admin paths from untrusted networks where possible.
  • Apply egress filtering and network allowlisting so the server cannot reach sensitive internal or metadata addresses through arbitrary outbound requests.
  • Review web and application logs for unusual requests to valider_xml.php and unexpected var_url values during the affected period.
  • Use the vendor patch references listed in the CVE record as part of remediation validation.

Evidence notes

This debrief is based only on the supplied CVE/NVD metadata and the linked references listed there. The key supported facts are: affected versions are SPIP 3.1.2 and earlier, the issue is SSRF in ecrire/exec/valider_xml.php via var_url, NVD assigns CWE-918, and the CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. The reference list includes OSS-security mailing-list posts, SPIP revision links marked as patch/vendor advisory, a SecurityFocus advisory entry, and a third-party Sysdream article. The CVE publication date used for chronology is 2017-01-18; the later modified date is record maintenance and not the original issue date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7999 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7999

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7999 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7999

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.