A file upload vulnerability in Spip 4.1.10 enables attackers to perform cross-site scripting and malicious redirection by leveraging crafted SVG files against administrative users.

This vulnerability is classified as improper neutralization of input (CWE-79), where the application fails to adequately filter SVG file uploads. An attacker with low-level privileges can upload a malicious image to trick an administrator into executing unintended actions or visiting external sites.

The exploitation of this flaw can lead to unauthorized redirection of administrative users, potentially facilitating credential theft or session hijacking. With a CVSS score of 8.8, this vulnerability poses a high risk to organizational integrity by compromising the administrative interface, which could result in broader system takeover if the attacker successfully targets a high-privilege account.

Immediate Action: Restrict the ability to upload SVG files within the Spip administrative interface until a vendor-supplied patch is identified and applied.

Proactive Monitoring: Review web server access logs for suspicious file upload activity, particularly involving files with the .svg extension, and monitor for unusual redirect patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize SVG file uploads that contain embedded scripts or external link references.

Public Exploit Available: Yes, a public proof-of-concept exists via ExploitDB (ID 51557).

Given the availability of a public proof-of-concept and the potential for administrative compromise, this vulnerability should be treated with high urgency. Administrators must immediately restrict file upload capabilities for untrusted users and monitor administrative activity closely until an official security update is provided by the vendor.