---
id: CVE-2024-8517
title: SPIP Bigup Multipart File Upload OS Command Injection
summary: >-
  SPIP before 4.3.2, 4.2.16, and 

  4.1.18 is vulnerable to a command injection issue. A 

  remote and unauthenticated attacker can execute arbitrary operating system
  commands by sending a crafted multipart file upload HTTP request.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-73
  - CWE-78
vendor: SPIP
product: SPIP
affected:
  - SPIP >= 4.3.0 <= 4.3.1
  - SPIP >= 4.2.0 <= 4.2.15
  - SPIP >= 4.1.0 < 4.1.18
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2024-09-06T20:29:04.243583Z'
exploitAvailable: true
published: '2024-09-06'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:10.704Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-8517'
references:
  - url: >-
      https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/
  - url: >-
      https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html
  - url: 'https://vulncheck.com/advisories/spip-upload-rce'
  - url: 'https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/'
tags:
  - cve.org
  - exploit-available
epss: 0.94532
epssPercentile: 0.99854
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Chocapikk/CVE-2024-8517'
    - >-
      https://github.com/saadhassan77/SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517
  metasploit:
    - exploit/multi/http/spip_bigup_unauth_rce
  nuclei:
    - CVE-2024-8517
  checkedAt: '2026-11-03T08:40:12.830Z'
ingestedAt: '2026-11-03T08:39:35.535Z'
---

## Overview

SPIP before 4.3.2, 4.2.16, and 
4.1.18 is vulnerable to a command injection issue. A 
remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

## Affected

- `SPIP >= 4.3.0 <= 4.3.1`
- `SPIP >= 4.2.0 <= 4.2.15`
- `SPIP >= 4.1.0 < 4.1.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.