A critical code injection vulnerability in SPIP allows authenticated attackers to achieve remote code execution, threatening the integrity and availability of the system.

The application is vulnerable to improper control of code generation (CWE-94), which enables code injection. Per the CVSS vector, this vulnerability requires low privileges (PR:L) and allows an authenticated user in the private space to execute arbitrary code on the underlying server.

A successful exploit grants an attacker the ability to execute arbitrary commands, potentially leading to a full system compromise. With a CVSS score of 8.8, the impact on confidentiality, integrity, and availability is total, necessitating urgent remediation to prevent server takeover.

Immediate Action: Upgrade all SPIP installations to version 4.4.14 or higher immediately to patch the code injection vulnerability.

Proactive Monitoring: Monitor server logs and the private space access logs for suspicious activity or unauthorized script execution attempts.

Compensating Controls: Restrict access to the private management interface to known, trusted IP addresses and enforce strict file system permissions to limit the impact of potential code execution.

Public Exploit Available: false

Given the potential for remote code execution, this vulnerability poses a severe risk to the infrastructure. Organizations using SPIP must prioritize upgrading to version 4.4.14 to eliminate this critical security gap.