PT-2026-20839 · Spip · Spip

Glop + 1 · Published 2025-01-01 · Updated 2026-02-23 · CVE-2025-71241

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.3.6 SPIP versions prior to 4.2.17 SPIP versions prior to 4.1.20

Description SPIP versions prior to 4.3.6, 4.2.17, and 4.1.20 contain a Cross-Site Scripting (XSS) issue within the private area. The error message displayed by the transmettre API endpoint does not properly sanitize its content, which allows an attacker to inject malicious scripts. SPIP’s security screen offers some mitigation.

Recommendations Update to SPIP version 4.3.6 or later. Update to SPIP version 4.2.17 or later. Update to SPIP version 4.1.20 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-71241

Affected Products

Spip

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-71241 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-71241 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-71241 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-71241 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-71241 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-71241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71241 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2024571330046140728 · Twitter Post
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-3-6-SPIP-4-2-17-SPIP-4-1-20.html · Vendor Advisory, Patch
• https://git.spip.net/spip/spip · Note
• https://t.me/CVEtracker/45123 · Telegram Post
• https://twitter.com/CVEnew/status/2025892065905676539 · Twitter Post
• https://vulncheck.com/advisories/spip-cross-site-scripting-in-private-area · Note