SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.
SPIP versión 4.0.0 está afectado por una vulnerabilidad de ejecución remota de comandos. Para explotar la vulnerabilidad, un atacante debe diseñar una imagen maliciosa con doble extensión, subirla y luego hacer clic en ella para ejecutarla
It was discovered that SPIP incorrectly validated inputs. An authenticated attacker could possibly use this issue to execute arbitrary code. Charles Fol and Theo Gordyjan discovered that SPIP is vulnerable to cross site scripting. If a user were tricked into browsing a malicious SVG file, an attacker could possibly exploit this issue to execute arbitrary code. This issue was only fixed in Ubuntu 21.10.
