Critical severity9.8NVD Advisory· Published Jun 17, 2017· Updated May 13, 2026
CVE-2017-9736
CVE-2017-9736
Description
SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution.
Affected products
14cpe:2.3:a:spip:spip:3.1.0:*:*:*:*:*:*:*+ 13 more
- cpe:2.3:a:spip:spip:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.0:beta:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.0:rc:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.2.0:beta:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.2.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:spip:spip:3.2:alpha-1:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- core.spip.net/projects/spip/repository/revisions/23593nvdPatchVendor Advisory
- core.spip.net/projects/spip/repository/revisions/23594nvdPatchVendor Advisory
- contrib.spip.net/CRITICAL-security-update-SPIP-3-1-6-and-SPIP-3-2-BetanvdVendor Advisory
- www.debian.org/security/2017/dsa-3890nvd
News mentions
0No linked articles in our index yet.