# CVE-2016-7982: SPIP directory traversal in valider_xml.php

Source: https://junglewise.ai/threats/cve-2016-7982-spip-directory-traversal-in-valider-xml-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7982 · Severity: high · CVSS 7.5 · Published 2017-01-18

SPIP, a popular open-source content management system, is vulnerable to a directory traversal flaw. This allows an attacker to remotely browse and list files on the server that should be private. Such information can be used to map out the server's file structure or identify sensitive configuration files, potentially leading to further system compromise.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2016-7982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7982 being exploited in the wild.

**How severe is CVE-2016-7982?** High severity, with a CVSS score of 7.5, published 18 January 2017.

**Which products and versions are affected?** SPIP SPIP <= 3.1.2.

**Is there a fix for CVE-2016-7982?** A patch was published on 2016-09-28: Fixes issued in repository revision 23200 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7982 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-7982?** Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in 'ecrire/exec/valider_xml.php' within SPIP versions up to and including 3.1.2. The 'var_url' parameter in the 'valider_xml' action does not sufficiently sanitize user input, allowing remote attackers to use path traversal sequences (e.g., '../') or PHP wrappers (e.g., 'file://') to enumerate files and directories on the host system. An attacker can specify a directory and file extension to receive a list of matching files in the response. The vulnerability was addressed in version 3.1.3 by restricting the execution of 'valider_xml' to webmasters, implementing CSRF tokens, and adding stricter path validation.

## Affected products

- SPIP SPIP <= 3.1.2

## Timeline

- 2016-09-15: other: Initial discovery
- 2016-09-28: patched: Fixes issued in repository revision 23200
- 2016-09-30: other: SPIP 3.1.3 released
- 2017-01-18: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/10/05/17](http://www.openwall.com/lists/oss-security/2016/10/05/17)
- [http://www.openwall.com/lists/oss-security/2016/10/06/6](http://www.openwall.com/lists/oss-security/2016/10/06/6)
- [http://www.openwall.com/lists/oss-security/2016/10/12/8](http://www.openwall.com/lists/oss-security/2016/10/12/8)
- [http://www.securityfocus.com/bid/93451](http://www.securityfocus.com/bid/93451)
- [https://core.spip.net/projects/spip/repository/revisions/23200](https://core.spip.net/projects/spip/repository/revisions/23200)
- [https://sysdream.com/news/lab/2016-10-19-spip-3-1-1-3-1-2-file-enumeration-path-traversal-cve-2016-7982/](https://sysdream.com/news/lab/2016-10-19-spip-3-1-1-3-1-2-file-enumeration-path-traversal-cve-2016-7982/)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce)
- [SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)