# CVE-2016-7981: SPIP reflected XSS in valider_xml.php

Source: https://junglewise.ai/threats/cve-2016-7981-spip-reflected-xss-in-valider-xml-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7981 · Severity: medium · CVSS 6.1 · Published 2017-01-18

SPIP, a popular open-source content management system, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the web pages of other users. By tricking a user (such as an administrator) into clicking a specially crafted link, an attacker could steal login session information or perform unauthorized actions on the website. This could lead to a compromise of the site's management interface or the exposure of sensitive data.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2016-7981 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7981 being exploited in the wild.

**How severe is CVE-2016-7981?** Medium severity, with a CVSS score of 6.1, published 18 January 2017.

**Which products and versions are affected?** SPIP SPIP <= 3.1.2.

**Is there a fix for CVE-2016-7981?** A patch was published on 2016-09-27: Fixes issued in SPIP repository (revisions 23200, 23201, 23202) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7981 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-7981?** Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in SPIP versions 3.1.2 and earlier within the 'valider_xml.php' script. The root cause is the improper sanitization of the 'var_url' parameter before it is echoed back to the user in the 'valider_xml' action. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing JavaScript or HTML and persuading a logged-in user to visit it. Successful exploitation allows the execution of arbitrary script in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. The issue was addressed in SPIP 3.1.3 by improving input validation and restricting access to the affected component to webmasters.

## Affected products

- SPIP SPIP <= 3.1.2

## Timeline

- 2016-09-15: other: Initial discovery by Sysdream Labs
- 2016-09-27: patched: Fixes issued in SPIP repository (revisions 23200, 23201, 23202)
- 2016-09-30: other: SPIP 3.1.3 released
- 2016-10-12: disclosed: Public disclosure on oss-security mailing list
- 2017-01-18: advisory: NVD advisory published

## References

- [http://www.openwall.com/lists/oss-security/2016/10/05/17](http://www.openwall.com/lists/oss-security/2016/10/05/17)
- [http://www.openwall.com/lists/oss-security/2016/10/06/6](http://www.openwall.com/lists/oss-security/2016/10/06/6)
- [http://www.openwall.com/lists/oss-security/2016/10/12/7](http://www.openwall.com/lists/oss-security/2016/10/12/7)
- [http://www.securityfocus.com/bid/93451](http://www.securityfocus.com/bid/93451)
- [https://core.spip.net/projects/spip/repository/revisions/23200](https://core.spip.net/projects/spip/repository/revisions/23200)
- [https://core.spip.net/projects/spip/repository/revisions/23201](https://core.spip.net/projects/spip/repository/revisions/23201)
- [https://core.spip.net/projects/spip/repository/revisions/23202](https://core.spip.net/projects/spip/repository/revisions/23202)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce)
- [SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)